CCE Identifiers in Guide to the Secure Configuration of Red Hat Enterprise Linux 9

CCE ID | Rule Title | Description
CCE-90839-2 | Prefer to use a 64-bit Operating System when supported | Prefer installation of 64-bit operating systems when the CPU supports it.
CCE-90841-8 | Verify File Hashes with RPM | Without cryptographic integrity protections, system executables and files can be altered by unauthorized users without detection. The RPM package management system can check the hashes of installed software packages, including many that are important to system security. To verify that the cryptographic hash of system files and commands matches vendor values, run the following command to list which files on the system have hashes that differ from what is expected by the RPM database:
    $ rpm -Va --noconfig | grep '^..5'
A "c" in the second column indicates that a file is a configuration file, which may appropriately be expected to change. If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file:
    $ rpm -qf FILENAME
The package can be reinstalled from a dnf repository using the command:
    $ sudo dnf reinstall PACKAGENAME
Alternatively, the package can be reinstalled from trusted media using the command:
    $ sudo rpm -Uvh PACKAGENAME
CCE-90842-6 | Verify and Correct Ownership with RPM | The RPM package management system can check file ownership permissions of installed software packages, including many that are important to system security. After locating a file with incorrect permissions, which can be found with
    rpm -Va | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }'
run the following command to determine which package owns it:
    $ rpm -qf FILENAME
Next, run the following command to reset its permissions to the correct values:
    $ sudo rpm --setugids PACKAGENAME
CCE-90840-0 | Verify and Correct File Permissions with RPM | The RPM package management system can check file access permissions of installed software packages, including many that are important to system security. Verify that the file permissions of system files and commands match vendor values. Check the file permissions with the following command:
    $ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'
Output indicates files that do not match vendor defaults. After locating a file with incorrect permissions, run the following command to determine which package owns it:
    $ rpm -qf FILENAME
Next, run the following command to reset its permissions to the correct values:
    $ sudo rpm --setperms PACKAGENAME
CCE-90843-4 | Install AIDE | The `aide` package can be installed with the following command:
    $ sudo dnf install aide
CCE-83438-2 | Build and Test AIDE Database | Run the following command to generate a new database:
    $ sudo /usr/sbin/aide --init
By default, the database will be written to the file `/var/lib/aide/aide.db.new.gz`. Storing the database, the configuration file `/etc/aide.conf`, and the binary `/usr/sbin/aide` (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:
    $ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
To initiate a manual check, run the following command:
    $ sudo /usr/sbin/aide --check
If this check produces any unexpected output, investigate.
CCE-87757-1 | Configure AIDE to Verify the Audit Tools | The operating system file integrity tool must be configured to protect the integrity of the audit tools.
CCE-83437-4 | Configure Periodic Execution of AIDE | At a minimum, AIDE should be configured to run a weekly scan. To implement a daily execution of AIDE at 4:05am using cron, add the following line to `/etc/crontab`:
    05 4 * * * root  --check
To implement a weekly execution of AIDE at 4:05am using cron, add the following line to `/etc/crontab`:
    05 4 * * 0 root  --check
AIDE can be executed periodically through other means; this is merely one example. The usage of cron's special time codes, such as `@daily` and `@weekly` is acceptable.
CCE-90844-2 | Configure Notification of Post-AIDE Scan Details | AIDE should notify appropriate personnel of the details of a scan after the scan has been run. If AIDE has already been configured for periodic execution in `/etc/crontab`, append the following line to the existing AIDE line:
     | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
Otherwise, add the following line to `/etc/crontab`:
    05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
AIDE can be executed periodically through other means; this is merely one example.
| Configure AIDE to Use FIPS 140-2 for Validating Hashes | By default, the `sha512` option is added to the `NORMAL` ruleset in AIDE. If using a custom ruleset or the `sha512` option is missing, add `sha512` to the appropriate ruleset. For example, add `sha512` to the following line in `/etc/aide.conf`:
    NORMAL = FIPSR+sha512
AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default.
CCE-90837-6 | Configure AIDE to Verify Access Control Lists (ACLs) | By default, the `acl` option is added to the `FIPSR` ruleset in AIDE. If using a custom ruleset or the `acl` option is missing, add `acl` to the appropriate ruleset. For example, add `acl` to the following line in `/etc/aide.conf`:
    FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. The remediation provided with this rule adds `acl` to all rule sets available in `/etc/aide.conf`
CCE-83439-0 | Configure AIDE to Verify Extended Attributes | By default, the `xattrs` option is added to the `FIPSR` ruleset in AIDE. If using a custom ruleset or the `xattrs` option is missing, add `xattrs` to the appropriate ruleset. For example, add `xattrs` to the following line in `/etc/aide.conf`:
    FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. The remediation provided with this rule adds `xattrs` to all rule sets available in `/etc/aide.conf`
CCE-86547-7 | Enable Dracut FIPS Module | To enable FIPS mode, run the following command:
    fips-mode-setup --enable
To enable FIPS, the system requires that the `fips` module is added in `dracut` configuration. Check if `/etc/dracut.conf.d/40-fips.conf` contain `add_dracutmodules+=" fips "`
CCE-88742-2 | Enable FIPS Mode | To enable FIPS mode, run the following command:
    fips-mode-setup --enable
The `fips-mode-setup` command will configure the system in FIPS mode by automatically configuring the following: Setting the kernel FIPS mode flag (`/proc/sys/crypto/fips_enabled`) to `1` Creating `/etc/system-fips` Setting the system crypto policy in `/etc/crypto-policies/config` to `` Loading the Dracut `fips` module
| Ensure '/etc/system-fips' exists | On a system where FIPS mode is enabled, `/etc/system-fips` must exist. To enable FIPS mode, run the following command:
    fips-mode-setup --enable
CCE-83441-6 | Set kernel parameter 'crypto.fips_enabled' to 1 | System running in FIPS mode is indicated by kernel parameter `'crypto.fips_enabled'`. This parameter should be set to `1` in FIPS mode. To enable FIPS mode, run the following command:
    fips-mode-setup --enable
CCE-83442-4 | Install crypto-policies package | The `crypto-policies` package can be installed with the following command:
    $ sudo dnf install crypto-policies
CCE-83451-5 | Configure BIND to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. BIND is supported by crypto policy, but the BIND configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `/etc/named.conf` includes the appropriate configuration: In the `options` section of `/etc/named.conf`, make sure that the following line is not commented out or superseded by later includes: `include "/etc/crypto-policies/back-ends/bind.config";`
CCE-83450-7 | Configure System Cryptography Policy | To configure the system cryptography policy to use ciphers only from the `` policy, run the following command:
    $ sudo update-crypto-policies --set
The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the `/etc/crypto-policies/back-ends` are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied. Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.
CCE-83449-9 | Configure Kerberos to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. Kerberos is supported by crypto policy, but it's configuration may be set up to ignore it. To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at /etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config. If the symlink exists, kerberos is configured to use the system-wide crypto policy settings.
CCE-83446-5 | Configure Libreswan to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. Libreswan is supported by system crypto policy, but the Libreswan configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `/etc/ipsec.conf` includes the appropriate configuration file. In `/etc/ipsec.conf`, make sure that the following line is not commented out or superseded by later includes: `include /etc/crypto-policies/back-ends/libreswan.config`
CCE-83452-3 | Configure OpenSSL library to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSL is supported by crypto policy, but the OpenSSL configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file available under `/etc/pki/tls/openssl.cnf`. This file has the `ini` format, and it enables crypto policy support if there is a `[ crypto_policy ]` section that contains the `.include /etc/crypto-policies/back-ends/opensslcnf.config` directive.
CCE-83448-1 | Configure OpenSSL library to use TLS Encryption | Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSL. OpenSSL is by default configured to modify its configuration based on currently configured Crypto Policy. Editing the Crypto Policy back-end is not recommended. Check the crypto-policies(7) man page and choose a policy that configures TLS protocol to version 1.2 or higher, for example DEFAULT, FUTURE or FIPS policy. Or create and apply a custom policy that restricts minimum TLS version to 1.2. For example for versions prior to crypto-policies-20210617-1.gitc776d3e.el8.noarch this is expected:
    $ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config

    MinProtocol = TLSv1.2
Or for version crypto-policies-20210617-1.gitc776d3e.el8.noarch and newer this is expected:
    $ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config

    TLS.MinProtocol = TLSv1.2
    DTLS.MinProtocol = DTLSv1.2
CCE-83445-7 | Configure SSH to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. SSH is supported by crypto policy, but the SSH configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `CRYPTO_POLICY` variable is either commented or not set at all in the `/etc/sysconfig/sshd`.
| Harden SSH client Crypto Policy | Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH client. To override the system wide crypto policy for Openssh client, place a file in the `/etc/ssh/ssh_config.d/` so that it is loaded before the `05-redhat.conf`. In this case it is file named `02-ospp.conf` containing parameters which need to be changed with respect to the crypto policy. This rule checks if the file exists and if it contains required parameters and values which modify the Crypto Policy. During the parsing process, as soon as Openssh client parses some configuration option and its value, it remembers it and ignores any subsequent overrides. The customization mechanism provided by crypto policies appends eventual customizations at the end of the system wide crypto policy. Therefore, if the crypto policy customization overrides some parameter which is already configured in the system wide crypto policy, the SSH client will not honor that customized parameter.
CCE-90125-6 | Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be set up incorrectly. To check that Crypto Policies settings for ciphers are configured correctly, ensure that `/etc/crypto-policies/back-ends/openssh.config` contains the following line and is not commented out:
    Ciphers
CCE-87332-3 | Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be set up incorrectly. To check that Crypto Policies settings for ciphers are configured correctly, ensure that `/etc/crypto-policies/back-ends/opensshserver.config` contains the following text and is not commented out:
    -oCiphers=
CCE-86208-6 | Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be set up incorrectly. To check that Crypto Policies settings are configured correctly, ensure that `/etc/crypto-policies/back-ends/openssh.config` contains the following line and is not commented out: `MACs hmac-sha2-512,hmac-sha2-256`
CCE-87567-4 | Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be set up incorrectly. To check that Crypto Policies settings are configured correctly, ensure that `/etc/crypto-policies/back-ends/opensshserver.config` contains the following text and is not commented out: `-oMACS=hmac-sha2-512,hmac-sha2-256`
| The Installed Operating System Is FIPS 140-2 Certified | To enable processing of sensitive information the operating system must provide certified cryptographic modules compliant with FIPS 140-2 standard.
CCE-83453-1 | The Installed Operating System Is Vendor Supported | The installed operating system must be maintained by a vendor. Red Hat Enterprise Linux is supported by Red Hat, Inc. As the Red Hat Enterprise Linux vendor, Red Hat, Inc. is responsible for providing security patches.
| Configure Backups of User Data | The operating system must conduct backups of user data contained in the operating system. The operating system provides utilities for automating backups of user data. Commercial and open-source products are also available.
CCE-88837-0 | Install Intrusion Detection Software | The base Red Hat Enterprise Linux 9 platform already includes a sophisticated auditing system that can detect intruder activity, as well as SELinux, which provides host-based intrusion prevention capabilities by confining privileged programs and user sessions which may become compromised.
CCE-86236-7 | Install McAfee Endpoint Security for Linux (ENSL) | Install McAfee Endpoint Security for Linux antivirus software which is provided for DoD systems and uses signatures to search for the presence of viruses on the filesystem. The `mcafeetp` package can be installed with the following command:
    $ sudo dnf install mcafeetp
CCE-88806-5 | Ensure McAfee Endpoint Security for Linux (ENSL) is running | Install McAfee Endpoint Security for Linux antivirus software which is provided for DoD systems and uses signatures to search for the presence of viruses on the filesystem.
| Install the Host Intrusion Prevention System (HIPS) Module | Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is absolutely necessary. If SELinux is enabled, do not install or enable this module.
CCE-90849-1 | Encrypt Partitions | Red Hat Enterprise Linux 9 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time. For manual installations, select the `Encrypt` checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots. For automated/unattended installations, it is possible to use Kickstart by adding the `--encrypted` and `--passphrase=` options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:
    part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE
Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the `--passphrase=` option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation. By default, the `Anaconda` installer uses `aes-xts-plain64` cipher with a minimum `512` bit key size which should be compatible with FIPS enabled. Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on the Red Hat Enterprise Linux 9 Documentation web site: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/encrypting-block-devices-using-luks_security-hardening.
CCE-83468-9 | Ensure /home Located On Separate Partition | If user home directories will be stored locally, create a separate partition for `/home` at installation time (or migrate it later using LVM). If `/home` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.
CCE-90846-7 | Ensure /srv Located On Separate Partition | If a file server (FTP, TFTP...) is hosted locally, create a separate partition for `/srv` at installation time (or migrate it later using LVM). If `/srv` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.
CCE-90845-9 | Ensure /tmp Located On Separate Partition | The `/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.
CCE-83466-3 | Ensure /var Located On Separate Partition | The `/var` directory is used by daemons and other system services to store frequently-changing data. Ensure that `/var` has its own partition or logical volume at installation time, or migrate it using LVM.
CCE-90848-3 | Ensure /var/log Located On Separate Partition | System logs are stored in the `/var/log` directory. Ensure that `/var/log` has its own partition or logical volume at installation time, or migrate it using LVM.
CCE-90847-5 | Ensure /var/log/audit Located On Separate Partition | Audit logs are stored in the `/var/log/audit` directory. Ensure that `/var/log/audit` has its own partition or logical volume at installation time, or migrate it using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon.
CCE-83487-9 | Ensure /var/tmp Located On Separate Partition | The `/var/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.
CCE-83549-6 | Remove the GDM Package Group | By removing the `gdm` package, the system no longer has GNOME installed installed. If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a `graphical.target` mode. To do so, run the following command:
    $ sudo yum remove gdm
CCE-87295-2 | Make sure that the dconf databases are up-to-date with regards to respective keyfiles | By default, DConf uses a binary database as a data backend. The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by the
    dconf update
command. More specifically, content present in the following directories:
    /etc/dconf/db/distro.d
    /etc/dconf/db/local.d
CCE-88767-9 | Configure GNOME3 DConf User Profile | By default, DConf provides a standard user profile. This profile contains a list of DConf configuration databases. The user profile and database always take the highest priority. As such the DConf User profile should always exist and be configured correctly. To make sure that the user profile is configured correctly, the `/etc/dconf/profile/user` should be set as follows:
    user-db:user
    system-db:local
    system-db:site
    system-db:distro
CCE-86315-9 | Disable the GNOME3 Login Restart and Shutdown Buttons | In the default graphical environment, users logging directly into the system are greeted with a login screen that allows any user, known or unknown, the ability the ability to shutdown or restart the system. This functionality should be disabled by setting `disable-restart-buttons` to `true`. To disable, add or edit `disable-restart-buttons` to `/etc/dconf/db/distro.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    disable-restart-buttons=true
Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/disable-restart-buttons
After the settings have been set, run `dconf update`.
CCE-88285-2 | Disable the GNOME3 Login User List | In the default graphical environment, users logging directly into the system are greeted with a login screen that displays all known users. This functionality should be disabled by setting `disable-user-list` to `true`. To disable, add or edit `disable-user-list` to `/etc/dconf/db/distro.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    disable-user-list=true
Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/disable-user-list
After the settings have been set, run `dconf update`.
CCE-86580-8 | Enable the GNOME3 Login Smartcard Authentication | In the default graphical environment, smart card authentication can be enabled on the login screen by setting `enable-smartcard-authentication` to `true`. To enable, add or edit `enable-smartcard-authentication` to `/etc/dconf/db/distro.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    enable-smartcard-authentication=true
Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/enable-smartcard-authentication
After the settings have been set, run `dconf update`.
CCE-86452-0 | Enable the GNOME3 Screen Locking On Smartcard Removal | In the default graphical environment, screen locking on smartcard removal can be enabled by setting `removal-action` to `'lock-screen'`. To enable, add or edit `removal-action` to `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/settings-daemon/peripherals/smartcard]
    removal-action='lock-screen'
Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/settings-daemon/peripherals/smartcard/removal-action
After the settings have been set, run `dconf update`.
CCE-87638-3 | Set the GNOME3 Login Number of Failures | In the default graphical environment, the GNOME3 login screen and be configured to restart the authentication process after a configured number of attempts. This can be configured by setting `allowed-failures` to `3` or less. To enable, add or edit `allowed-failures` to `/etc/dconf/db/distro.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    allowed-failures=3
Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/allowed-failures
After the settings have been set, run `dconf update`.
CCE-89663-9 | Disable GDM Automatic Login | The GNOME Display Manager (GDM) can allow users to automatically login without user interaction or credentials. User should always be required to authenticate themselves to the system that they are authorized to use. To disable user ability to automatically login to the system, set the `AutomaticLoginEnable` to `false` in the `[daemon]` section in `/etc/gdm/custom.conf`. For example:
    [daemon]
    AutomaticLoginEnable=false
| Disable XDMCP in GDM | XDMCP is an unencrypted protocol, and therefore, presents a security risk, see e.g. XDMCP Gnome docs. To disable XDMCP support in Gnome, set `Enable` to `false` under the `[xdmcp]` configuration section in `/etc/gdm/custom.conf`. For example:
    [xdmcp]
    Enable=false
CCE-87734-0 | Disable GNOME3 Automounting | The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount within GNOME3, add or set `automount` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/media-handling]
    automount=false
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/media-handling/automount
After the settings have been set, run `dconf update`.
CCE-90128-0 | Disable GNOME3 Automount Opening | The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount-open within GNOME3, add or set `automount-open` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/media-handling]
    automount-open=false
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/media-handling/automount-open
After the settings have been set, run `dconf update`.
CCE-90257-7 | Disable GNOME3 Automount running | The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable autorun-never within GNOME3, add or set `autorun-never` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/media-handling]
    autorun-never=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/media-handling/autorun-never
After the settings have been set, run `dconf update`.
CCE-88714-1 | Disable All GNOME3 Thumbnailers | The system's default desktop environment, GNOME3, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. To disable the execution of these thumbnail applications, add or set `disable-all` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/thumbnailers]
    disable-all=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/thumbnailers/disable-all
After the settings have been set, run `dconf update`. This effectively prevents an attacker from gaining access to a system through a flaw in GNOME3's Nautilus thumbnail creators.
CCE-86409-0 | Disable WIFI Network Connection Creation in GNOME3 | `GNOME` allows users to create ad-hoc wireless connections through the `NetworkManager` applet. Wireless connections should be disabled by adding or setting `disable-wifi-create` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/nm-applet]
    disable-wifi-create=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/nm-applet/disable-wifi-create
After the settings have been set, run `dconf update`.
CCE-87894-2 | Disable WIFI Network Notification in GNOME3 | By default, `GNOME` disables WIFI notification. This should be permanently set so that users do not connect to a wireless network when the system finds one. While useful for mobile devices, this setting should be disabled for all other systems. To configure the system to disable the WIFI notication, add or set `suppress-wireless-networks-available` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/nm-applet]
    suppress-wireless-networks-available=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/nm-applet/suppress-wireless-networks-available
After the settings have been set, run `dconf update`.
CCE-87524-5 | Require Credential Prompting for Remote Access in GNOME3 | By default, `GNOME` does not require credentials when using `Vino` for remote access. To configure the system to require remote credentials, add or set `authentication-methods` to `['vnc']` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/Vino]
    authentication-methods=['vnc']
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/Vino/authentication-methods
After the settings have been set, run `dconf update`.
CCE-88756-2 | Require Encryption for Remote Access in GNOME3 | By default, `GNOME` requires encryption when using `Vino` for remote access. To prevent remote access encryption from being disabled, add or set `require-encryption` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/Vino]
    require-encryption=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/Vino/require-encryption
After the settings have been set, run `dconf update`.
CCE-87755-5 | Enable GNOME3 Screensaver Idle Activation | To activate the screensaver in the GNOME3 desktop after a period of inactivity, add or set `idle-activation-enabled` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    idle-activation-enabled=true
Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/idle-activation-enabled
After the settings have been set, run `dconf update`.
CCE-86819-0 | Ensure Users Cannot Change GNOME3 Screensaver Idle Activation | If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding
    /org/gnome/desktop/screensaver/idle-activation-enabled
to `/etc/dconf/db/local.d/00-security-settings`. For example:
    /org/gnome/desktop/screensaver/idle-activation-enabled
After the settings have been set, run `dconf update`.
CCE-86510-5 | Set GNOME3 Screensaver Inactivity Timeout | The idle time-out value for inactivity in the GNOME3 desktop is configured via the `idle-delay` setting must be set under an appropriate configuration file(s) in the `/etc/dconf/db/local.d` directory and locked in `/etc/dconf/db/local.d/locks` directory to prevent user modification. For example, to configure the system for a 15 minute delay, add the following to `/etc/dconf/db/local.d/00-security-settings`:
    [org/gnome/desktop/session]
    idle-delay=uint32 900
Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/session/idle-delay
After the settings have been set, run `dconf update`.
CCE-86954-5 | Set GNOME3 Screensaver Lock Delay After Activation Period | To activate the locking delay of the screensaver in the GNOME3 desktop when the screensaver is activated, add or set `lock-delay` to `uint32` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    lock-delay=uint32
Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/lock-delay
After the settings have been set, run `dconf update`.
CCE-89302-4 | Enable GNOME3 Screensaver Lock After Idle Period | To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set `lock-enabled` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    lock-enabled=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/lock-enabled
After the settings have been set, run `dconf update`.
CCE-90150-4 | Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period | If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding
    /org/gnome/desktop/screensaver/lock-enabled
to `/etc/dconf/db/local.d/00-security-settings`. For example:
    /org/gnome/desktop/screensaver/lock-enabled
After the settings have been set, run `dconf update`.
CCE-88733-1 | Implement Blank Screensaver | To set the screensaver mode in the GNOME3 desktop to a blank screen, add or set `picture-uri` to `string ''` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    picture-uri=''
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/picture-uri
After the settings have been set, run `dconf update`.
CCE-87468-5 | Disable Full User Name on Splash Shield | By default when the screen is locked, the splash shield will show the user's full name. This should be disabled to prevent casual observers from seeing who has access to the system. This can be disabled by adding or setting `show-full-name-in-top-bar` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    show-full-name-in-top-bar=false
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/show-full-name-in-top-bar
After the settings have been set, run `dconf update`.
CCE-87491-7 | Ensure Users Cannot Change GNOME3 Screensaver Settings | If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding `/org/gnome/desktop/screensaver/lock-delay` to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/lock-delay
After the settings have been set, run `dconf update`.
CCE-85971-0 | Ensure Users Cannot Change GNOME3 Session Idle Settings | If not already configured, ensure that users cannot change GNOME3 session idle settings by adding `/org/gnome/desktop/session/idle-delay` to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/session/idle-delay
After the settings have been set, run `dconf update`.
CCE-88653-1 | Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3 | By default, `GNOME` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the Graphical User Interface (GUI) instead of rebooting the system, add or set `logout` to `''` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/settings-daemon/plugins/media-keys]
    logout=''
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/settings-daemon/plugins/media-keys/logout
After the settings have been set, run `dconf update`.
CCE-85903-3 | Disable Geolocation in GNOME3 | `GNOME` allows the clock and applications to track and access location information. This setting should be disabled as applications should not track system location. To configure the system to disable location tracking, add or set `enabled` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/system/location]
    enabled=false
To configure the clock to disable location tracking, add or set `geolocation` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/clocks]
    geolocation=false
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/system/location/enabled
    /org/gnome/clocks/geolocation
After the settings have been set, run `dconf update`.
CCE-87338-0 | Disable Power Settings in GNOME3 | By default, `GNOME` enables a power profile designed for mobile devices with battery usage. While useful for mobile devices, this setting should be disabled for all other systems. To configure the system to disable the power setting, add or set `active` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/settings-daemon/plugins/power]
    active=false
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/settings-daemon/plugins/power
After the settings have been set, run `dconf update`.
CCE-88185-4 | Disable User Administration in GNOME3 | By default, `GNOME` will allow all users to have some administratrion capability. This should be disabled so that non-administrative users are not making configuration changes. To configure the system to disable user administration capability in the Graphical User Interface (GUI), add or set `user-administration-disabled` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/lockdown]
    user-administration-disabled=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/lockdown/user-administration-disabled
After the settings have been set, run `dconf update`.
CCE-83523-1 | Install sudo Package | The `sudo` package can be installed with the following command:
    $ sudo dnf install sudo
CCE-83537-1 | Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC | The sudo `NOEXEC` tag, when specified, prevents user executed commands from executing other commands, like a shell for example. This should be enabled by making sure that the `NOEXEC` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.
CCE-83539-7 | Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty | The sudo `requiretty` tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the `requiretty` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.
CCE-83538-9 | Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty | The sudo `use_pty` tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the `use_pty` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.
CCE-83527-2 | Ensure Sudo Logfile Exists - sudo logfile | A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CIS, which uses /var/log/sudo.log.
CCE-83544-7 | Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate | The sudo `!authenticate` option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the `!authenticate` option does not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.
CCE-83536-3 | Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD | The sudo `NOPASSWD` tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the `NOPASSWD` tag does not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.
CCE-83543-9 | Ensure Users Re-Authenticate for Privilege Escalation - sudo | The sudo `NOPASSWD` and `!authenticate` option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that `NOPASSWD` and/or `!authenticate` do not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`."
CCE-90029-0 | The operating system must require Re-Authentication when using the sudo command. Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout | The sudo `timestamp_timeout` tag sets the amount of time sudo password prompt waits. The default `timestamp_timeout` value is 5 minutes. The timestamp_timeout should be configured by making sure that the `timestamp_timeout` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`. If the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated.
CCE-83525-6 | The operating system must restrict privilege elevation to authorized personnel | The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. Restrict privileged actions by removing the following entries from the sudoers file: `ALL ALL=(ALL) ALL` `ALL ALL=(ALL:ALL) ALL`
CCE-83528-0 | Only the VDSM User Can Use sudo NOPASSWD | The sudo `NOPASSWD` tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the `vdsm` user should have this capability in any sudo configuration snippets in `/etc/sudoers.d/`.
CCE-86477-7 | Ensure sudo only includes the default configuration directory | Administrators can configure authorized `sudo` users via drop-in files, and it is possible to include other directories and configuration files from the file currently being parsed. Make sure that `/etc/sudoers` only includes drop-in configuration files from `/etc/sudoers.d`. The `/etc/sudoers` should contain only one `#includedir` directive pointing to `/etc/sudoers.d`, and no file in `/etc/sudoers.d/` should include other files or directories. Note that the '#' character doesn't denote a comment in the configuration file.
CCE-83545-4 | Explicit arguments in sudo specifications | All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user. If the command is supposed to be executed only without arguments, pass "" as an argument in the corresponding user specification.
CCE-83524-9 | Don't define allowed commands in sudoers by means of exclusion | Policies applied by sudo through the sudoers file should not involve negation. Each user specification in the `sudoers` file contains a comma-delimited list of command specifications. The definition can make use glob patterns, as well as of negations. Indirect definition of those commands by means of exclusion of a set of commands is trivial to bypass, so it is not allowed to use such constructs.
CCE-83531-4 | Don't target root user in the sudoers file | The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root). User specifications have to explicitly list the runas spec (i.e. the list of target users that can be impersonated), and `ALL` or `root` should not be used.
CCE-83529-8 | Ensure invoking users password for privilege escalation when using sudo | The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. The expected output for:
    sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'
     /etc/sudoers:Defaults !targetpw
          /etc/sudoers:Defaults !rootpw
          /etc/sudoers:Defaults !runaspw
CCE-83494-5 | Ensure gnutls-utils is installed | The `gnutls-utils` package can be installed with the following command:
    $ sudo dnf install gnutls-utils
| Ensure nss-tools is installed | The `nss-tools` package can be installed with the following command:
    $ sudo dnf install nss-tools
CCE-83502-5 | Install openscap-scanner Package | The `openscap-scanner` package can be installed with the following command:
    $ sudo dnf install openscap-scanner
CCE-83503-3 | Install rear Package | The `rear` package can be installed with the following command:
    $ sudo dnf install rear
CCE-83504-1 | Install rng-tools Package | The `rng-tools` package can be installed with the following command:
    $ sudo dnf install rng-tools
CCE-83505-8 | Install scap-security-guide Package | The `scap-security-guide` package can be installed with the following command:
    $ sudo dnf install scap-security-guide
CCE-83506-6 | Install subscription-manager Package | The `subscription-manager` package can be installed with the following command:
    $ sudo dnf install subscription-manager
| Uninstall geolite2-city Package | The `geolite2-city` package can be removed with the following command:
    $ sudo dnf erase geolite2-city
| Uninstall geolite2-country Package | The `geolite2-country` package can be removed with the following command:
    $ sudo dnf erase geolite2-country
CCE-83516-5 | Uninstall gssproxy Package | The `gssproxy` package can be removed with the following command:
    $ sudo dnf erase gssproxy
CCE-83519-9 | Uninstall iprutils Package | The `iprutils` package can be removed with the following command:
    $ sudo dnf erase iprutils
CCE-83520-7 | Uninstall krb5-workstation Package | The `krb5-workstation` package can be removed with the following command:
    $ sudo dnf erase krb5-workstation
CCE-83521-5 | Uninstall tuned Package | The `tuned` package can be removed with the following command:
    $ sudo dnf erase tuned
CCE-83454-9 | Install dnf-automatic Package | The `dnf-automatic` package can be installed with the following command:
    $ sudo dnf install dnf-automatic
CCE-83458-0 | Ensure dnf Removes Previous Package Versions | `dnf` should be configured to remove previous software components after new versions have been installed. To configure `dnf` to remove the previous software components after updating, set the `clean_requirements_on_remove` to `1` in `/etc/dnf/dnf.conf`.
CCE-83456-4 | Configure dnf-automatic to Install Available Updates Automatically | To ensure that the packages comprising the available updates will be automatically installed by `dnf-automatic`, set `apply_updates` to `yes` under `[commands]` section in `/etc/dnf/automatic.conf`.
CCE-83461-4 | Configure dnf-automatic to Install Only Security Updates | To configure `dnf-automatic` to install only security updates automatically, set `upgrade_type` to `security` under `[commands]` section in `/etc/dnf/automatic.conf`.
CCE-83457-2 | Ensure gpgcheck Enabled In Main dnf Configuration | The `gpgcheck` option controls whether RPM packages' signatures are always checked prior to installation. To configure dnf to check package signatures before installing them, ensure the following line appears in `/etc/dnf/dnf.conf` in the `[main]` section:
    gpgcheck=1
CCE-83463-0 | Ensure gpgcheck Enabled for Local Packages | `dnf` should be configured to verify the signature(s) of local packages prior to installation. To configure `dnf` to verify signatures of local packages, set the `localpkg_gpgcheck` to `1` in `/etc/dnf/dnf.conf`.
CCE-83464-8 | Ensure gpgcheck Enabled for All dnf Package Repositories | To ensure signature checking is not disabled for any repos, remove any lines from files in `/etc/yum.repos.d` of the form:
    gpgcheck=0
CCE-84180-9 | Ensure Red Hat GPG Key Installed | To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them), the Red Hat GPG key must properly be installed. To install the Red Hat GPG key, run:
    $ sudo subscription-manager register
If the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in `/media/cdrom`, use the following command as the root user to import it into the keyring:
    $ sudo rpm --import /media/cdrom/RPM-GPG-KEY
Alternatively, the key may be pre-loaded during the RHEL installation. In such cases, the key can be installed by running the following command:
    sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
CCE-84185-8 | Ensure Software Patches Installed | NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy dictates.
CCE-83459-8 | Enable dnf-automatic Timer | The `dnf-automatic` timer can be enabled with the following command:
    $ sudo systemctl enable dnf-automatic.timer
CCE-83557-9 | Modify the System Login Banner | To configure the system login banner edit `/etc/issue`. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either: `You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.` OR: `I've read & consent to terms in IS user agreem't.`
CCE-83559-5 | Modify the System Message of the Day Banner | To configure the system message banner edit `/etc/motd`. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either: `You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.` OR: `I've read & consent to terms in IS user agreem't.`
CCE-83551-2 | Verify permissions on System Login Banner | To properly set the permissions of `/etc/issue`, run the command:
    $ sudo chmod 0644 /etc/issue
CCE-83554-6 | Verify permissions on Message of the Day Banner | To properly set the permissions of `/etc/motd`, run the command:
    $ sudo chmod 0644 /etc/motd
CCE-87599-7 | Enable GNOME3 Login Warning Banner | In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login screen by setting `banner-message-enable` to `true`. To enable, add or edit `banner-message-enable` to `/etc/dconf/db/distro.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    banner-message-enable=true
Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/banner-message-enable
After the settings have been set, run `dconf update`. The banner text must also be set.
CCE-86529-5 | Set the GNOME3 Login Warning Banner Text | In the default graphical environment, configuring the login warning banner text in the GNOME Display Manager's login screen can be configured on the login screen by setting `banner-message-text` to `'APPROVED_BANNER'` where APPROVED_BANNER is the approved banner for your environment. To enable, add or edit `banner-message-text` to `/etc/dconf/db/distro.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    banner-message-text='APPROVED_BANNER'
Once the setting has been added, add a lock to `/etc/dconf/db/distro.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/banner-message-text
After the settings have been set, run `dconf update`. When entering a warning banner that spans several lines, remember to begin and end the string with `'` and use `\n` for new lines.
| Install pam_pwquality Package | The `libpwquality` package can be installed with the following command:
    $ sudo dnf install libpwquality
| Disallow Configuration to Bypass Password Requirements for Privilege Escalation | Verify the operating system is not configured to bypass password requirements for privilege escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command:
    $ sudo grep pam_succeed_if /etc/pam.d/sudo
If any occurrences of "pam_succeed_if" is returned from the command, this is a finding.
CCE-83560-3 | Ensure PAM Displays Last Logon/Access Notification | To configure the system to notify users of last logon/access using `pam_lastlog`, add or correct the `pam_lastlog` settings in `/etc/pam.d/postlogin` to read as follows:
    session     required pam_lastlog.so showfailed
And make sure that the `silent` option is not set.
CCE-86354-8 | Limit Password Reuse: password-auth | Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_pwhistory` PAM modules. In the file `/etc/pam.d/password-auth`, make sure the parameter `remember` is present, and that the value for the `remember` parameter is or greater. For example:
    password  pam_pwhistory.so ...existing_options... remember= use_authtok
The DoD STIG requirement is 5 passwords.
CCE-89176-2 | Limit Password Reuse: system-auth | Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_pwhistory` PAM modules. In the file `/etc/pam.d/system-auth`, make sure the parameter `remember` is present, and that the value for the `remember` parameter is or greater. For example:
    password  pam_pwhistory.so ...existing_options... remember= use_authtok
The DoD STIG requirement is 5 passwords.
- CCE-83584-3 | Limit Password Reuse | Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_unix` or `pam_pwhistory` PAM modules. In the file `/etc/pam.d/system-auth`, append `remember=` to the line which refers to the `pam_unix.so` or `pam_pwhistory.so`module, as shown below: for the `pam_unix.so` case:
      password sufficient pam_unix.so ...existing_options... remember=
- for the `pam_pwhistory.so` case:
      password requisite pam_pwhistory.so ...existing_options... remember=
The DoD STIG requirement is 5 passwords.
CCE-83587-6 | Lock Accounts After Failed Password Attempts | This rule configures the system to lock out accounts after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version.
CCE-83589-2 | Configure the root Account for Failed Password Attempts | This rule configures the system to lock out the `root` account after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version.
- | Enforce pam_faillock for Local Accounts Only | The pam_faillock module's `local_users_only` parameter controls requirements for enforcing failed lockout attempts only for local user accounts and ignoring centralized user account management failed attempt configurations. To enable the `local_users_only` setting in `/etc/security/faillock.conf`, first enable pam_faillock.so using the following command:
      authselect enable-feature with-faillock
- Then edit the `/etc/security/faillock.conf` file as follows: add or uncomment the following line:
      local_users_only
- add or uncomment the following line:
      silent
- CCE-83583-5 | Set Interval For Counting Failed Password Attempts | Utilizing `pam_faillock.so`, the `fail_interval` directive configures the system to lock out an account after a number of incorrect login attempts within a specified time period. First make sure the feature is enabled using the following command:
      authselect enable-feature with-faillock
- Then edit the `/etc/security/faillock.conf` file as follows: add, uncomment or edit the following line:
      fail_interval =
- add or uncomment the following line:
      silent
CCE-83588-4 | Set Lockout Time for Failed Password Attempts | This rule configures the system to lock out accounts during a specified time period after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version.
CCE-83566-0 | Ensure PAM Enforces Password Requirements - Minimum Digit Characters | The pam_pwquality module's `dcredit` parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional length credit for each digit. Modify the `dcredit` setting in `/etc/security/pwquality.conf` to require the use of a digit in passwords.
CCE-88413-0 | Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words | The pam_pwquality module's `dictcheck` check if passwords contains dictionary words. When `dictcheck` is set to `1` passwords will be checked for dictionary words.
CCE-83564-5 | Ensure PAM Enforces Password Requirements - Minimum Different Characters | The pam_pwquality module's `difok` parameter sets the number of characters in a password that must not be present in and old password during a password change. Modify the `difok` setting in `/etc/security/pwquality.conf` to equal to require differing characters when changing passwords.
| Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only | The pam_pwquality module's `local_users_only` parameter controls requirements for enforcing password complexity by pam_pwquality only for local user accounts and ignoring centralized user account management password complexity configurations. Enable the `local_users_only` setting in `/etc/security/pwquality.conf` to require password complexity enforcement for only local user accounts.
| Ensure PAM Enforces Password Requirements - Enforce for root User | The pam_pwquality module's `enforce_for_root` parameter controls requirements for enforcing password complexity for the root user. Enable the `enforce_for_root` setting in `/etc/security/pwquality.conf` to require the `root` user to use complex passwords.
CCE-83570-2 | Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters | The pam_pwquality module's `lcredit` parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each lowercase character. Modify the `lcredit` setting in `/etc/security/pwquality.conf` to require the use of a lowercase character in passwords.
CCE-83575-1 | Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class | The pam_pwquality module's `maxclassrepeat` parameter controls requirements for consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters from the same character class. Modify the `maxclassrepeat` setting in `/etc/security/pwquality.conf` to equal to prevent a run of ( + 1) or more identical characters.
CCE-83567-8 | Set Password Maximum Consecutive Repeating Characters | The pam_pwquality module's `maxrepeat` parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Modify the `maxrepeat` setting in `/etc/security/pwquality.conf` to equal to prevent a run of ( + 1) or more identical characters.
CCE-83563-7 | Ensure PAM Enforces Password Requirements - Minimum Different Categories | The pam_pwquality module's `minclass` parameter controls requirements for usage of different character classes, or types, of character that must exist in a password before it is considered valid. For example, setting this value to three (3) requires that any password must have characters from at least three different categories in order to be approved. The default value is zero (0), meaning there are no required classes. There are four categories available:
    * Upper-case characters
    * Lower-case characters
    * Digits
    * Special characters (for example, punctuation)
Modify the `minclass` setting in `/etc/security/pwquality.conf` entry to require differing categories of characters when changing passwords.
CCE-83579-3 | Ensure PAM Enforces Password Requirements - Minimum Length | The pam_pwquality module's `minlen` parameter controls requirements for minimum characters required in a password. Add `minlen=` after pam_pwquality to set minimum password length requirements.
CCE-83565-2 | Ensure PAM Enforces Password Requirements - Minimum Special Characters | The pam_pwquality module's `ocredit=` parameter controls requirements for usage of special (or "other") characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each special character. Modify the `ocredit` setting in `/etc/security/pwquality.conf` to equal to require use of a special character in passwords.
CCE-85878-7 | Ensure PAM password complexity module is enabled in password-auth | To enable PAM password complexity in password-auth file: Edit the `password` section in `/etc/pam.d/password-auth` to show `password requisite pam_pwquality.so`.
CCE-85873-8 | Ensure PAM password complexity module is enabled in system-auth | To enable PAM password complexity in system-auth file: Edit the `password` section in `/etc/pam.d/system-auth` to show `password requisite pam_pwquality.so`.
CCE-83569-4 | Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session | To configure the number of retry prompts that are permitted per-session: Edit the `/etc/security/pwquality.conf` to include `retry=`, or a lower value if site policy is more restrictive. The DoD requirement is a maximum of 3 prompts per session.
CCE-83568-6 | Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters | The pam_pwquality module's `ucredit=` parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each uppercase character. Modify the `ucredit` setting in `/etc/security/pwquality.conf` to require the use of an uppercase character in passwords.
CCE-88865-1 | Set Password Hashing Algorithm in /etc/libuser.conf | In `/etc/libuser.conf`, add or correct the following line in its `[defaults]` section to ensure the system will use the SHA-512 algorithm for password hashing:
    crypt_style = sha512
CCE-90590-1 | Set Password Hashing Algorithm in /etc/login.defs | In `/etc/login.defs`, add or correct the following line to ensure the system will use SHA-512 as the hashing algorithm:
    ENCRYPT_METHOD SHA512
CCE-85946-2 | Set PAM's Password Hashing Algorithm - password-auth | The PAM system service can be configured to only store encrypted representations of passwords. In `/etc/pam.d/password-auth`, the `password` section of the file controls which PAM modules execute during a password change. Set the `pam_unix.so` module in the `password` section to include the argument `sha512`, as shown below:
    password    sufficient    pam_unix.so sha512 other arguments...
This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default.
CCE-83581-9 | Set PAM's Password Hashing Algorithm | The PAM system service can be configured to only store encrypted representations of passwords. In `/etc/pam.d/system-auth`, the `password` section of the file controls which PAM modules execute during a password change. Set the `pam_unix.so` module in the `password` section to include the argument `sha512`, as shown below:
    password    sufficient    pam_unix.so sha512 other arguments...
This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default.
CCE-90724-6 | Disable debug-shell SystemD Service | SystemD's `debug-shell` service is intended to diagnose SystemD related boot issues with various `systemctl` commands. Once enabled and following a system reboot, the root shell will be available on `tty9` which is access by pressing `CTRL-ALT-F9`. The `debug-shell` service should only be used for SystemD related issues and should otherwise be disabled. By default, the `debug-shell` SystemD service is already disabled. The `debug-shell` service can be disabled with the following command:
    $ sudo systemctl mask --now debug-shell.service
CCE-90308-8 | Disable Ctrl-Alt-Del Burst Action | By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds. To configure the system to ignore the `CtrlAltDelBurstAction` setting, add or modify the following to `/etc/systemd/system.conf`:
    CtrlAltDelBurstAction=none
CCE-86667-3 | Disable Ctrl-Alt-Del Reboot Activation | By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the command line instead of rebooting the system, do either of the following:
    ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target
or
    systemctl mask ctrl-alt-del.target
Do not simply delete the `/usr/lib/systemd/system/ctrl-alt-del.service` file, as this file may be restored during future system updates.
CCE-87114-5 | Verify that Interactive Boot is Disabled | Red Hat Enterprise Linux 9 systems support an "interactive boot" option that can be used to prevent services from being started. On a Red Hat Enterprise Linux 9 system, interactive boot can be enabled by providing a `1`, `yes`, `true`, or `on` value to the `systemd.confirm_spawn` kernel argument in `/etc/default/grub`. Remove any instance of
    systemd.confirm_spawn=(1|yes|true|on)
from the kernel arguments in that file to disable interactive boot. It is also required to change the runtime configuration, run:
    /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
CCE-83592-6 | Require Authentication for Emergency Systemd Target | Emergency mode is intended as a system recovery method, providing a single user root access to the system during a failed boot sequence. By default, Emergency mode is protected by requiring a password and is set in `/usr/lib/systemd/system/emergency.service`.
CCE-83594-2 | Require Authentication for Single User Mode | Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected. By default, single-user mode is protected by requiring a password and is set in `/usr/lib/systemd/system/rescue.service`.
CCE-83599-1 | Install the tmux Package | To enable console screen locking, install the `tmux` package. A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, Red Hat Enterprise Linux 9 needs to provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity. Instruct users to begin new terminal sessions with the following command:
    $ tmux
The console can now be locked with the following key combination:
    ctrl+b :lock-session
CCE-90586-9 | Support session locking with tmux | The `tmux` terminal multiplexer is used to implement automatic session locking. It should be started from `/etc/bashrc` or drop-in files within `/etc/profile.d/`.
CCE-89876-7 | Configure tmux to lock session after inactivity | To enable console screen locking in `tmux` terminal multiplexer after a period of inactivity, the `lock-after-time` option has to be set to nonzero value in `/etc/tmux.conf`.
CCE-90171-0 | Configure the tmux Lock Command | To enable console screen locking in `tmux` terminal multiplexer, the `vlock` command must be configured to be used as a locking mechanism. Add the following line to `/etc/tmux.conf`:
    set -g lock-command vlock
. The console can now be locked with the following key combination:
    ctrl+b :lock-session
CCE-89538-3 | Prevent user from disabling the screen lock | The `tmux` terminal multiplexer is used to implement automatic session locking. It should not be listed in `/etc/shells`.
CCE-83595-9 | Install the opensc Package For Multifactor Authentication | The `opensc` package can be installed with the following command:
    $ sudo dnf install opensc
CCE-86280-5 | Install the pcsc-lite package | The `pcsc-lite` package can be installed with the following command:
    $ sudo dnf install pcsc-lite
CCE-83596-7 | Install Smart Card Packages For Multifactor Authentication | Configure the operating system to implement multifactor authentication by installing the required package with the following command: The `openssl-pkcs11` package can be installed with the following command:
    $ sudo dnf install openssl-pkcs11
CCE-87907-2 | Enable the pcscd Service | The `pcscd` service can be enabled with the following command:
    $ sudo systemctl enable pcscd.service
CCE-89122-6 | Configure opensc Smart Card Drivers | The OpenSC smart card tool can auto-detect smart card drivers; however, setting the smart card drivers in use by your organization helps to prevent users from using unauthorized smart cards. The default smart card driver for this profile is ``. To configure the OpenSC driver, edit the `/etc/opensc.conf` and add the following line into the file in the `app default` block, so it will look like:
    app default {
       ...
       card_drivers = ;
    }
CCE-89151-5 | Force opensc To Use Defined Smart Card Driver | The OpenSC smart card middleware can auto-detect smart card drivers; however by forcing the smart card driver in use by your organization, opensc will no longer autodetect or use other drivers unless specified. This helps to prevent users from using unauthorized smart cards. The default smart card driver for this profile is ``. To force the OpenSC driver, edit the `/etc/opensc.conf`. Look for a line similar to:
    # force_card_driver = customcos;
and change it to:
    force_card_driver = ;
CCE-88493-2 | Ensure All Accounts on the System Have Unique User IDs | Change user IDs (UIDs), or delete accounts, so each has a unique name.
CCE-88048-4 | Only Authorized Local User Accounts Exist on Operating System | Enterprise Application tends to use the server or virtual machine exclusively. Besides the default operating system user, there should be only authorized local users required by the installed software groups and applications that exist on the operating system. The authorized user list can be customized in the refine value variable `var_accounts_authorized_local_users_regex`. OVAL regular expression is used for the user list. Configure the system so all accounts on the system are assigned to an active system, application, or user account. Remove accounts that do not support approved system activities or that allow for a normal user to perform administrative-level actions. To remove unauthorized system accounts, use the following command:
    $ sudo userdel unauthorized_user
CCE-83627-0 | Set Account Expiration Following Inactivity | To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following line in `/etc/default/useradd`:
    INACTIVE=
If a password is currently on the verge of expiration, then `` day(s) remain(s) until the account is automatically disabled. However, if the password will not expire for another 60 days, then 60 days plus `` day(s) could elapse until the account would be automatically disabled. See the `useradd` man page for more information.
CCE-90560-4 | Assign Expiration Date to Emergency Accounts | Emergency accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. In the event emergency accounts are required, configure the system to terminate them after a documented time period. For every emergency account, run the following command to set an expiration date on it, substituting `ACCOUNT_NAME` and `YYYY-MM-DD` appropriately:
    $ sudo chage -E YYYY-MM-DD ACCOUNT_NAME
`YYYY-MM-DD` indicates the documented expiration date for the account. For U.S. Government systems, the operating system must be configured to automatically terminate these types of accounts after a period of 72 hours.
CCE-90096-9 | Assign Expiration Date to Temporary Accounts | Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts. In the event temporary or emergency accounts are required, configure the system to terminate them after a documented time period. For every temporary and emergency account, run the following command to set an expiration date on it, substituting `USER` and `YYYY-MM-DD` appropriately:
    $ sudo chage -E YYYY-MM-DD USER
`YYYY-MM-DD` indicates the documented expiration date for the account. For U.S. Government systems, the operating system must be configured to automatically terminate these types of accounts after a period of 72 hours.
CCE-83628-8 | Ensure All Accounts on the System Have Unique Names | Ensure accounts on the system have unique names. To ensure all accounts have unique names, run the following command:
    $ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
If a username is returned, change or delete the username.
| Use Centralized and Automated Authentication | Implement an automated system for managing user accounts that minimizes the risk of errors, either intentional or deliberate. This system should integrate with an existing enterprise user management system, such as one based on Identity Management tools such as Active Directory, Kerberos, Directory Server, etc.
CCE-83606-4 | Set Password Maximum Age | To specify password maximum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_MAX_DAYS
A value of 180 days is sufficient for many environments. The DoD requirement is 60. The profile requirement is ``.
CCE-83610-6 | Set Password Minimum Age | To specify password minimum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_MIN_DAYS
A value of 1 day is considered sufficient for many environments. The DoD requirement is 1. The profile requirement is ``.
CCE-83608-0 | Set Password Minimum Length in login.defs | To specify password length requirements for new accounts, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_MIN_LEN
The DoD requirement is `15`. The FISMA requirement is `12`. The profile requirement is ``. If a program consults `/etc/login.defs` and also another PAM module (such as `pam_pwquality`) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements.
CCE-86031-2 | Set Existing Passwords Maximum Age | Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction by running the following command:
    $ sudo chage -M 60 USER
CCE-89069-9 | Set Existing Passwords Minimum Age | Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime by running the following command:
    $ sudo chage -m 1 USER
CCE-83609-8 | Set Password Warning Age | To specify how many days prior to password expiration that a warning will be issued to users, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_WARN_AGE
The DoD requirement is 7. The profile requirement is ``.
CCE-83618-9 | Verify All Account Password Hashes are Shadowed | If any password hashes are stored in `/etc/passwd` (in the second field, instead of an `x` or `*`), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely.
CCE-89983-1 | Verify All Account Password Hashes are Shadowed with SHA512 | Verify the operating system requires the shadow password suite configuration be set to encrypt interactive user passwords using a strong cryptographic hash. Check that the interactive user account passwords are using a strong password hash with the following command:
    # sudo cut -d: -f2 /etc/shadow
    $6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/
Password hashes `!` or `*` indicate inactive accounts not available for logon and are not evaluated. If any interactive user password hash does not begin with `$6`, this is a finding.
CCE-83615-5 | Set number of Password Hashing Rounds - password-auth | Configure the number or rounds for the password hashing algorithm. This can be accomplished by using the `rounds` option for the `pam_unix` PAM module. In file `/etc/pam.d/password-auth` append `rounds=` to the `pam_unix.so` file, as shown below:
    password sufficient pam_unix.so ...existing_options... rounds=
The system's default number of rounds is 5000.
CCE-83621-3 | Set number of Password Hashing Rounds - system-auth | Configure the number or rounds for the password hashing algorithm. This can be accomplished by using the `rounds` option for the `pam_unix` PAM module. In file `/etc/pam.d/system-auth` append `rounds=` to the `pam_unix.so` file, as shown below:
    password sufficient pam_unix.so ...existing_options... rounds=
The system's default number of rounds is 5000.
CCE-83613-0 | All GIDs referenced in /etc/passwd must be defined in /etc/group | Add a group to the system for each GID referenced without a corresponding group.
CCE-83611-4 | Prevent Login to Accounts With Empty Password | If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the `nullok` in `/etc/pam.d/system-auth` to prevent logins with empty passwords.
| Ensure There Are No Accounts With Blank or Null Passwords | Check the "/etc/shadow" file for blank passwords with the following command:
    $ sudo awk -F: '!$2 {print $1}' /etc/shadow
If the command returns any results, this is a finding. Configure all accounts on the system to have a password or lock the account with the following commands: Perform a password reset:
    $ sudo passwd [username]
Lock an account:
    $ sudo passwd -l [username]
CCE-83616-3 | Ensure there are no legacy + NIS entries in /etc/group | The `+` character in `/etc/group` file marks a place where entries from a network information service (NIS) should be directly inserted.
CCE-83620-5 | Ensure there are no legacy + NIS entries in /etc/passwd | The `+` character in `/etc/passwd` file marks a place where entries from a network information service (NIS) should be directly inserted.
CCE-83612-2 | Ensure there are no legacy + NIS entries in /etc/shadow | The `+` character in `/etc/shadow` file marks a place where entries from a network information service (NIS) should be directly inserted.
CCE-83617-1 | Verify No netrc Files Exist | The `.netrc` files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any `.netrc` files should be removed.
CCE-83624-7 | Verify Only Root Has UID 0 | If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed. If the account is associated with system commands or applications the UID should be changed to one greater than "0" but less than "1000." Otherwise assign a UID greater than "1000" that has not already been assigned.
CCE-86298-7 | Verify Root Has A Primary GID 0 | The `root` user should have a primary group of 0.
CCE-83625-4 | Direct root Logins Not Allowed | To further limit access to the `root` account, administrators can disable root logins at the console by editing the `/etc/securetty` file. This file lists all devices the root user is allowed to login to. If the file does not exist at all, the root user can login through any communication device on the system, whether via the console or via a raw network interface. This is dangerous as user can login to the system as root via Telnet, which sends the password in plain text over the network. By default, Red Hat Enterprise Linux 9's `/etc/securetty` file only allows the root user to login at the console physically attached to the system. To prevent root from logging in, remove the contents of this file. To prevent direct root logins, remove the contents of this file by typing the following command:
    $ sudo echo > /etc/securetty
| Ensure that System Accounts Are Locked | Some accounts are not associated with a human user of the system, and exist to perform some administrative function. An attacker should not be able to log into these accounts. System accounts are those user accounts with a user ID less than UID_MIN, where value of the UID_MIN directive is set in `/etc/login.defs` configuration file. In the default configuration UID_MIN is set to 500, thus system accounts are those user accounts with a user ID less than 500. If any system account SYSACCT (other than root) has an unlocked password, disable it with the command:
    $ sudo passwd -l SYSACCT
CCE-83623-9 | Ensure that System Accounts Do Not Run a Shell Upon Login | Some accounts are not associated with a human user of the system, and exist to perform some administrative function. Should an attacker be able to log into these accounts, they should not be granted access to a shell. The login shell for each local account is stored in the last field of each line in `/etc/passwd`. System accounts are those user accounts with a user ID less than UID_MIN, where value of UID_MIN directive is set in /etc/login.defs configuration file. In the default configuration UID_MIN is set to 1000, thus system accounts are those user accounts with a user ID less than 1000. The user ID is stored in the third field. If any system account SYSACCT (other than root) has a login shell, disable it with the command:
    $ sudo usermod -s /sbin/nologin SYSACCT
CCE-83622-1 | Restrict Serial Port Root Logins | To restrict root logins on serial ports, ensure lines of this form do not appear in `/etc/securetty`:
    ttyS0
    ttyS1
CCE-83626-2 | Restrict Virtual Console Root Logins | To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in `/etc/securetty`:
    vc/1
    vc/2
    vc/3
    vc/4
CCE-90085-2 | Enforce usage of pam_wheel for su authentication | To ensure that only users who are members of the `wheel` group can run commands with altered privileges through the `su` command, make sure that the following line exists in the file `/etc/pam.d/su`:
    auth             required        pam_wheel.so use_uid
CCE-88983-2 | Ensure Home Directories are Created for New Users | All local interactive user accounts, upon creation, should be assigned a home directory. Configure the operating system to assign home directories to all new local interactive users by setting the `CREATE_HOME` parameter in `/etc/login.defs` to `yes` as follows:
    CREATE_HOME yes
CCE-83635-3 | Ensure the Logon Failure Delay is Set Correctly in login.defs | To ensure the logon failure delay controlled by `/etc/login.defs` is set properly, add or correct the `FAIL_DELAY` setting in `/etc/login.defs` to read as follows:
    FAIL_DELAY
CCE-83641-1 | Limit the Number of Concurrent Login Sessions Allowed Per User | Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in `/etc/security/limits.conf` or a file under `/etc/security/limits.d/`:
    * hard maxlogins
CCE-90827-7 | Configure Polyinstantiation of /tmp Directories | To configure polyinstantiated /tmp directories, first create the parent directories which will hold the polyinstantiation child directories. Use the following command:
    $ sudo mkdir --mode 000 /tmp/tmp-inst
Then, add the following entry to `/etc/security/namespace.conf`:
    /tmp     /tmp/tmp-inst/            level      root,adm
CCE-83642-9 | Configure Polyinstantiation of /var/tmp Directories | To configure polyinstantiated /tmp directories, first create the parent directories which will hold the polyinstantiation child directories. Use the following command:
    $ sudo mkdir --mode 000 /var/tmp/tmp-inst
Then, add the following entry to `/etc/security/namespace.conf`:
    /var/tmp /var/tmp/tmp-inst/    level      root,adm
CCE-83633-8 | Set Interactive Session Timeout | Setting the `TMOUT` option in `/etc/profile` ensures that all user sessions will terminate based on inactivity. The `TMOUT` setting in a file loaded by `/etc/profile`, e.g. `/etc/profile.d/tmout.sh` should read as follows:
    TMOUT=
CCE-87451-1 | User Initialization Files Must Not Run World-Writable Programs | Set the mode on files being executed by the user initialization files with the following command:
    $ sudo chmod 0755 FILE
CCE-87487-5 | Ensure that Users Path Contains Only Local Directories | Ensure that all interactive user initialization files executable search path statements do not contain statements that will reference a working directory other than the users home directory.
CCE-88964-2 | All Interactive Users Must Have A Home Directory Defined | Assign home directories to all interactive users that currently do not have a home directory assigned. This rule checks if the home directory is properly defined in a folder which has at least one parent folder, like "user" in "/home/user" or "/remote/users/user". Therefore, this rule will report a finding for home directories like `/users`, `/tmp` or `/`.
CCE-83639-5 | All Interactive Users Home Directories Must Exist | Create home directories to all interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in `/etc/passwd`:
    $ sudo mkdir /home/USER
CCE-83629-6 | All Interactive User Home Directories Must Be Group-Owned By The Primary User | Change the group owner of interactive users home directory to the group found in `/etc/passwd`. To change the group owner of interactive users home directory, use the following command:
    $ sudo chgrp USER_GROUP /home/USER
This rule ensures every home directory related to an interactive user is group-owned by an interactive user. It also ensures that interactive users are group-owners of one and only one home directory.
CCE-83637-9 | Ensure All User Initialization Files Have Mode 0740 Or Less Permissive | Set the mode of the user initialization files to `0740` with the following command:
    $ sudo chmod 0740 /home/USER/.INIT_FILE
CCE-83634-6 | All Interactive User Home Directories Must Have mode 0750 Or Less Permissive | Change the mode of interactive users home directories to `0750`. To change the mode of interactive users home directory, use the following command:
    $ sudo chmod 0750 /home/USER
CCE-83638-7 | Ensure that User Home Directories are not Group-Writable or World-Readable | For each human user of the system, view the permissions of the user's home directory:
    # ls -ld /home/USER
Ensure that the directory is not group-writable and that it is not world-readable. If necessary, repair the permissions:
    # chmod g-w /home/USER
    # chmod o-rwx /home/USER
CCE-83643-7 | Ensure that Root's Path Does Not Include World or Group-Writable Directories | For each element in root's path, run:
    # ls -ld DIR
and ensure that write permissions are disabled for group and other.
CCE-88059-1 | Ensure that Root's Path Does Not Include Relative Paths or Null Directories | Ensure that none of the directories in root's path is equal to a single `.` character, or that it contains any instances that lead to relative path traversal, such as `..` or beginning a path without the slash (`/`) character. Also ensure that there are no "empty" elements in the path, such as in these examples:
    PATH=:/bin
    PATH=/bin:
    PATH=/bin::/sbin
These empty elements have the same effect as a single `.` character.
CCE-83644-5 | Ensure the Default Bash Umask is Set Correctly | To ensure the default umask for users of the Bash shell is set properly, add or correct the `umask` setting in `/etc/bashrc` to read as follows:
    umask
CCE-87721-7 | Ensure the Default C Shell Umask is Set Correctly | To ensure the default umask for users of the C shell is set properly, add or correct the `umask` setting in `/etc/csh.cshrc` to read as follows:
    umask
CCE-83647-8 | Ensure the Default Umask is Set Correctly in login.defs | To ensure the default umask controlled by `/etc/login.defs` is set properly, add or correct the `UMASK` setting in `/etc/login.defs` to read as follows:
    UMASK
CCE-90828-5 | Ensure the Default Umask is Set Correctly in /etc/profile | To ensure the default umask controlled by `/etc/profile` is set properly, add or correct the `umask` setting in `/etc/profile` to read as follows:
    umask
CCE-90365-8 | Ensure the Default Umask is Set Correctly For Interactive Users | Remove the `UMASK` environment variable from all interactive users initialization files.
CCE-83648-6 | Install audispd-plugins Package | The `audispd-plugins` package can be installed with the following command:
    $ sudo dnf install audispd-plugins
| Ensure the default plugins for the audit dispatcher are Installed | The audit-audispd-plugins package should be installed.
CCE-83649-4 | Ensure the audit Subsystem is Installed | The audit package should be installed.
CCE-90829-3 | Enable auditd Service | The `auditd` service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The `auditd` service can be enabled with the following command:
    $ sudo systemctl enable auditd.service
CCE-83651-0 | Enable Auditing for Processes Which Start Prior to the Audit Daemon | To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument `audit=1` to the default GRUB 2 command line for the Linux operating system. To ensure that `audit=1` is added as a kernel command line argument to newly installed kernels, ad `audit=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... audit=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="audit=1"
CCE-83652-8 | Extend Audit Backlog Limit for the Audit Daemon | To improve the kernel capacity to queue all log events, even those which occurred prior to the audit daemon, add the argument `audit_backlog_limit=8192` to the default GRUB 2 command line for the Linux operating system. To ensure that `audit_backlog_limit=8192` is added as a kernel command line argument to newly installed kernels, ad `audit_backlog_limit=8192` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... audit_backlog_limit=8192 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="audit_backlog_limit=8192"
| Record Events that Modify User/Group Information via open syscall - /etc/group | The audit system should collect write events to /etc/group file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
| Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group | The audit system should collect write events to /etc/group file for all group and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
| Record Events that Modify User/Group Information via openat syscall - /etc/group | The audit system should collect write events to /etc/group file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
| Record Events that Modify User/Group Information via open syscall - /etc/gshadow | The audit system should collect write events to /etc/gshadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow | The audit system should collect write events to /etc/gshadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Record Events that Modify User/Group Information via openat syscall - /etc/gshadow | The audit system should collect write events to /etc/gshadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Record Events that Modify User/Group Information via open syscall - /etc/passwd | The audit system should collect write events to /etc/passwd file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
| Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd | The audit system should collect write events to /etc/passwd file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
| Record Events that Modify User/Group Information via openat syscall - /etc/passwd | The audit system should collect write events to /etc/passwd file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
| Record Events that Modify User/Group Information via open syscall - /etc/shadow | The audit system should collect write events to /etc/shadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow | The audit system should collect write events to /etc/shadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Record Events that Modify User/Group Information via openat syscall - /etc/shadow | The audit system should collect write events to /etc/shadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
CCE-83716-1 | Make the auditd Configuration Immutable | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to make the auditd configuration immutable:
    -e 2
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file in order to make the auditd configuration immutable:
    -e 2
With this setting, a reboot will be required to change any audit rules.
CCE-83721-1 | Record Events that Modify the System's Mandatory Access Controls | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /etc/selinux/ -p wa -k MAC-policy
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -w /etc/selinux/ -p wa -k MAC-policy
CCE-83735-1 | Ensure auditd Collects Information on Exporting to Media (successful) | At a minimum, the audit system should collect media exportation events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export
CCE-83706-2 | Record Events that Modify the System's Network Environment | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
    -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
    -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
CCE-83713-8 | Record Attempts to Alter Process and Session Initiation Information | The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing such process information:
    -w /var/run/utmp -p wa -k session
    -w /var/log/btmp -p wa -k session
    -w /var/log/wtmp -p wa -k session
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for attempted manual edits of files involved in storing such process information:
    -w /var/run/utmp -p wa -k session
    -w /var/log/btmp -p wa -k session
    -w /var/log/wtmp -p wa -k session
CCE-90176-9 | Ensure auditd Collects System Administrator Actions - /etc/sudoers | At a minimum, the audit system should collect administrator actions for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /etc/sudoers -p wa -k actions
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -w /etc/sudoers -p wa -k actions
CCE-89498-0 | Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/ | At a minimum, the audit system should collect administrator actions for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /etc/sudoers.d/ -p wa -k actions
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -w /etc/sudoers.d/ -p wa -k actions
CCE-86402-5 | Record Events When Privileged Executables Are Run | Verify the system generates an audit record when privileged functions are executed.
    # grep -iw execve /etc/audit/audit.rules
    -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
    -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
    -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
    -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding. If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding.
CCE-83729-4 | Ensure auditd Collects System Administrator Actions | At a minimum, the audit system should collect administrator actions for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /etc/sudoers -p wa -k actions
    -w /etc/sudoers.d/ -p wa -k actions
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -w /etc/sudoers -p wa -k actions
    -w /etc/sudoers.d/ -p wa -k actions
CCE-83709-6 | Shutdown System When Auditing Failures Occur | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -f 2
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to the top of the `/etc/audit/audit.rules` file:
    -f 2
CCE-83715-3 | Record Events that Modify User/Group Information | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/group -p wa -k audit_rules_usergroup_modification
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/group -p wa -k audit_rules_usergroup_modification
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
CCE-83722-9 | Record Events that Modify User/Group Information - /etc/group | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/group -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/group -p wa -k audit_rules_usergroup_modification
CCE-83723-7 | Record Events that Modify User/Group Information - /etc/gshadow | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
CCE-83712-0 | Record Events that Modify User/Group Information - /etc/security/opasswd | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
CCE-83714-6 | Record Events that Modify User/Group Information - /etc/passwd | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
CCE-83725-2 | Record Events that Modify User/Group Information - /etc/shadow | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
| Record Access Events to Audit Log Directory | The audit system should collect access events to read audit log directory. The following audit rule will assure that access to audit log directory are collected.
    -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rule to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rule to `/etc/audit/audit.rules` file.
CCE-90516-6 | System Audit Directories Must Be Group Owned By Root | All audit directories must be group owned by root user. By default, the path for audit log is
    /var/log/audit/
. To properly set the group owner of `/var/log/audit`, run the command:
    $ sudo chgrp root /var/log/audit
If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the group ownership of the audit directories to this specific group.
CCE-85869-6 | System Audit Directories Must Be Owned By Root | All audit directories must be owned by root user. By default, the path for audit log is
    /var/log/audit/
. To properly set the owner of `/var/log/audit`, run the command:
    $ sudo chown root /var/log/audit
CCE-83734-4 | System Audit Logs Must Have Mode 0750 or Less Permissive | If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the mode of the audit log files with the following command:
    $ sudo chmod 0750 /var/log/audit
Otherwise, change the mode of the audit log files with the following command:
    $ sudo chmod 0700 /var/log/audit
CCE-89603-5 | System Audit Logs Must Be Group Owned By Root | All audit logs must be group owned by root user. The path for audit log can be configured via `log_file` parameter in
    /etc/audit/auditd.conf
or, by default, the path for audit log is
    /var/log/audit/
. To properly set the group owner of `/var/log/audit/*`, run the command:
    $ sudo chgrp root /var/log/audit/*
If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the group ownership of the audit logs to this specific group.
| Audit Configuration Files Must Be Owned By Group root | All audit configuration files must be owned by group root.
    chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*
| Audit Configuration Files Must Be Owned By Root | All audit configuration files must be owned by root user. To properly set the owner of `/etc/audit/`, run the command:
    $ sudo chown root /etc/audit/
To properly set the owner of `/etc/audit/rules.d/`, run the command:
    $ sudo chown root /etc/audit/rules.d/
CCE-83726-0 | System Audit Logs Must Be Owned By Root | All audit logs must be owned by root user and group. By default, the path for audit log is
    /var/log/audit/
. To properly set the owner of `/var/log/audit`, run the command:
    $ sudo chown root /var/log/audit
To properly set the owner of `/var/log/audit/*`, run the command:
    $ sudo chown root /var/log/audit/*
CCE-89952-6 | System Audit Logs Must Be Owned By Root | All audit logs must be owned by root user. The path for audit log can be configured via `log_file` parameter in
    /etc/audit/auditd.conf
or by default, the path for audit log is
    /var/log/audit/
. To properly set the owner of `/var/log/audit/*`, run the command:
    $ sudo chown root /var/log/audit/*
CCE-83720-3 | System Audit Logs Must Have Mode 0640 or Less Permissive | If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the mode of the audit log files with the following command:
    $ sudo chmod 0640 audit_file
Otherwise, change the mode of the audit log files with the following command:
    $ sudo chmod 0600 audit_file
CCE-83830-0 | Record Events that Modify the System's Discretionary Access Controls - chmod | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-83812-8 | Record Events that Modify the System's Discretionary Access Controls - chown | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-83832-6 | Record Events that Modify the System's Discretionary Access Controls - fchmod | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-83822-7 | Record Events that Modify the System's Discretionary Access Controls - fchmodat | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-83829-2 | Record Events that Modify the System's Discretionary Access Controls - fchown | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-83831-8 | Record Events that Modify the System's Discretionary Access Controls - fchownat | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-83821-9 | Record Events that Modify the System's Discretionary Access Controls - fremovexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -F key=perm_mod
CCE-83817-7 | Record Events that Modify the System's Discretionary Access Controls - fsetxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -F key=perm_mod
CCE-83833-4 | Record Events that Modify the System's Discretionary Access Controls - lchown | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-83814-4 | Record Events that Modify the System's Discretionary Access Controls - lremovexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-83808-6 | Record Events that Modify the System's Discretionary Access Controls - lsetxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -F key=perm_mod
CCE-83807-8 | Record Events that Modify the System's Discretionary Access Controls - removexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S removexattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S removexattr -F auid=0 -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S removexattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S removexattr -F auid=0 -F key=perm_mod
CCE-83811-0 | Record Events that Modify the System's Discretionary Access Controls - setxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S setxattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S setxattr -F auid=0 -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S setxattr -F auid=0 -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S setxattr -F auid=0 -F key=perm_mod
| Record Events that Modify the System's Discretionary Access Controls - umount | At a minimum, the audit system should collect file system umount changes. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -F key=perm_mod
| Record Events that Modify the System's Discretionary Access Controls - umount2 | At a minimum, the audit system should collect file system umount2 changes. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
CCE-87685-4 | Record Any Attempts to Run chacl | At a minimum, the audit system should collect any execution attempt of the `chacl` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-90482-1 | Record Any Attempts to Run setfacl | At a minimum, the audit system should collect any execution attempt of the `setfacl` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83748-4 | Record Any Attempts to Run chcon | At a minimum, the audit system should collect any execution attempt of the `chcon` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83749-2 | Record Any Attempts to Run restorecon | At a minimum, the audit system should collect any execution attempt of the `restorecon` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83750-0 | Record Any Attempts to Run semanage | At a minimum, the audit system should collect any execution attempt of the `semanage` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83736-9 | Record Any Attempts to Run setfiles | At a minimum, the audit system should collect any execution attempt of the `setfiles` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83751-8 | Record Any Attempts to Run setsebool | At a minimum, the audit system should collect any execution attempt of the `setsebool` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83746-8 | Record Any Attempts to Run seunshare | At a minimum, the audit system should collect any execution attempt of the `seunshare` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83752-6 | Ensure auditd Collects File Deletion Events by User | At a minimum the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename -S renameat -F auid>=1000 -F auid!=unset -F key=delete
CCE-83754-2 | Ensure auditd Collects File Deletion Events by User - rename | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete
CCE-83756-7 | Ensure auditd Collects File Deletion Events by User - renameat | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete
CCE-83758-3 | Ensure auditd Collects File Deletion Events by User - rmdir | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete
CCE-83757-5 | Ensure auditd Collects File Deletion Events by User - unlink | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete
CCE-83755-9 | Ensure auditd Collects File Deletion Events by User - unlinkat | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete
| Record Successful Permission Changes to Files - chmod | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S chmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S chmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S chmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S chmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Ownership Changes to Files - chown | At a minimum, the audit system should collect file ownership changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S chown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S chown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S chown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S chown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Access Attempts to Files - creat | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
| Record Successful Permission Changes to Files - fchmod | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Permission Changes to Files - fchmodat | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchmodat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchmodat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchmodat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchmodat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Ownership Changes to Files - fchown | At a minimum, the audit system should collect file ownership changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Ownership Changes to Files - fchownat | At a minimum, the audit system should collect file ownership changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Permission Changes to Files - fremovexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Permission Changes to Files - fsetxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Access Attempts to Files - ftruncate | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
| Record Successful Ownership Changes to Files - lchown | At a minimum, the audit system should collect file ownership changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Permission Changes to Files - lremovexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Permission Changes to Files - lsetxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Access Attempts to Files - open | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
| Record Successful Access Attempts to Files - open_by_handle_at | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
| Record Successful Creation Attempts to Files - open_by_handle_at O_CREAT | The `open_by_handle_at` syscall can be used to create new files when O_CREAT flag is specified. The following audit rules will assure that successful attempts to create a file via `open_by_handle_at` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
| Record Successful Creation Attempts to Files - open_by_handle_at O_TRUNC_WRITE | The audit system should collect detailed file access records for all users and root. The `open_by_handle_at` syscall can be used to modify files if called for write operation with the O_TRUNC_WRITE flag. The following audit rules will assure that successful attempts to create a file via `open_by_handle_at` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
| Record Successful Creation Attempts to Files - open O_CREAT | The `open` syscall can be used to create new files when O_CREAT flag is specified. The following audit rules will assure that successful attempts to create a file via `open` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
| Record Successful Creation Attempts to Files - open O_TRUNC_WRITE | The audit system should collect detailed file access records for all users and root. The `open` syscall can be used to modify files if called for write operation with the O_TRUNC_WRITE flag. The following audit rules will assure that successful attempts to create a file via `open` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
| Record Successful Access Attempts to Files - openat | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
| Record Successful Creation Attempts to Files - openat O_CREAT | The `openat` syscall can be used to create new files when O_CREAT flag is specified. The following audit rules will assure that successful attempts to create a file via `openat` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
| Record Successful Creation Attempts to Files - openat O_TRUNC_WRITE | The audit system should collect detailed file access records for all users and root. The `openat` syscall can be used to modify files if called for write operation with the O_TRUNC_WRITE flag. The following audit rules will assure that successful attempts to create a file via `openat` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
| Record Successful Permission Changes to Files - removexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S removexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S removexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S removexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S removexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Delete Attempts to Files - rename | At a minimum, the audit system should collect file deletion for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S rename -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S rename -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S rename -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S rename -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
| Record Successful Delete Attempts to Files - renameat | At a minimum, the audit system should collect file deletion for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
| Record Successful Permission Changes to Files - setxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S setxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S setxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S setxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S setxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
| Record Successful Access Attempts to Files - truncate | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S truncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S truncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S truncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S truncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
| Record Successful Delete Attempts to Files - unlink | At a minimum, the audit system should collect file deletion for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S unlink -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S unlink -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S unlink -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S unlink -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
| Record Successful Delete Attempts to Files - unlinkat | At a minimum, the audit system should collect file deletion for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S unlinkat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S unlinkat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S unlinkat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S unlinkat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
CCE-83793-0 | Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) | At a minimum the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Record Unsuccessul Permission Changes to Files - chmod | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S chmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S chmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S chmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S chmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Ownership Changes to Files - chown | The audit system should collect unsuccessful file ownership change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S chown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S chown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S chown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S chown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
CCE-83786-4 | Record Unsuccessful Access Attempts to Files - creat | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Record Unsuccessul Permission Changes to Files - fchmod | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fchmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fchmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fchmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Permission Changes to Files - fchmodat | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fchmodat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fchmodat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchmodat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fchmodat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Ownership Changes to Files - fchown | The audit system should collect unsuccessful file ownership change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Ownership Changes to Files - fchownat | The audit system should collect unsuccessful file ownership change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Permission Changes to Files - fremovexattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Permission Changes to Files - fsetxattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
CCE-83800-3 | Record Unsuccessful Access Attempts to Files - ftruncate | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S ftruncate -F exiu=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Record Unsuccessul Ownership Changes to Files - lchown | The audit system should collect unsuccessful file ownership change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S lchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S lchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S lchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Permission Changes to Files - lremovexattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S lremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S lremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S lremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Permission Changes to Files - lsetxattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S lsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S lsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S lsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
CCE-83801-1 | Record Unsuccessful Access Attempts to Files - open | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
CCE-83796-3 | Record Unsuccessful Access Attempts to Files - open_by_handle_at | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT | The audit system should collect unauthorized file accesses for all users and root. The `open_by_handle_at` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will asure that unsuccessful attempts to create a file via `open_by_handle_at` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
| Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE | The audit system should collect detailed unauthorized file accesses for all users and root. The `open_by_handle_at` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will asure that unsuccessful attempts to modify a file via `open_by_handle_at` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
| Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly | The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `open_by_handle_at` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `open_by_handle_at` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
| Record Unsuccessful Creation Attempts to Files - open O_CREAT | The audit system should collect unauthorized file accesses for all users and root. The `open` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will asure that unsuccessful attempts to create a file via `open` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
| Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE | The audit system should collect detailed unauthorized file accesses for all users and root. The `open` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will asure that unsuccessful attempts to modify a file via `open` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
| Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly | The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `open` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `open` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
CCE-83794-8 | Record Unsuccessful Access Attempts to Files - openat | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Record Unsuccessful Creation Attempts to Files - openat O_CREAT | The audit system should collect unauthorized file accesses for all users and root. The `openat` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will asure that unsuccessful attempts to create a file via `openat` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
| Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE | The audit system should collect detailed unauthorized file accesses for all users and root. The `openat` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will asure that unsuccessful attempts to modify a file via `openat` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
| Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly | The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `openat` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `openat` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
| Record Unsuccessul Permission Changes to Files - removexattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S removexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S removexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S removexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S removexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Record Unsuccessul Delete Attempts to Files - rename | The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
| Record Unsuccessul Delete Attempts to Files - renameat | The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
| Record Unsuccessul Permission Changes to Files - setxattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S setxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S setxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S setxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S setxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
CCE-83792-2 | Record Unsuccessful Access Attempts to Files - truncate | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Record Unsuccessul Delete Attempts to Files - unlink | The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
| Record Unsuccessul Delete Attempts to Files - unlinkat | The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
CCE-83804-5 | Ensure auditd Collects Information on Kernel Module Loading and Unloading | To capture kernel module loading and unloading events, use following lines, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
    -a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules
The place to add the lines depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the lines to file `/etc/audit/audit.rules`.
CCE-83802-9 | Ensure auditd Collects Information on Kernel Module Unloading - delete_module | To capture kernel module unloading events, use following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
    -a always,exit -F arch=ARCH -S delete_module -F key=modules
Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.
CCE-83803-7 | Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S finit_module -F key=modules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S finit_module -F key=modules
CCE-90835-0 | Ensure auditd Collects Information on Kernel Module Loading - init_module | To capture kernel module loading events, use following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
    -a always,exit -F arch=ARCH -S init_module -F key=modules
Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.
CCE-83784-9 | Record Attempts to Alter Logon and Logout Events | The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events:
    -w /var/log/tallylog -p wa -k logins
    -w /var/run/faillock -p wa -k logins
    -w /var/log/lastlog -p wa -k logins
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events:
    -w /var/log/tallylog -p wa -k logins
    -w /var/run/faillock -p wa -k logins
    -w /var/log/lastlog -p wa -k logins
CCE-83783-1 | Record Attempts to Alter Logon and Logout Events - faillock | The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events:
    -w /var/run/faillock -p wa -k logins
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events:
    -w /var/run/faillock -p wa -k logins
CCE-83785-6 | Record Attempts to Alter Logon and Logout Events - lastlog | The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events:
    -w /var/log/lastlog -p wa -k logins
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events:
    -w /var/log/lastlog -p wa -k logins
CCE-83782-3 | Record Attempts to Alter Logon and Logout Events - tallylog | The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events:
    -w /var/log/tallylog -p wa -k logins
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events:
    -w /var/log/tallylog -p wa -k logins
CCE-83759-1 | Ensure auditd Collects Information on the Use of Privileged Commands | The audit system should collect information about usage of privileged commands for all users and root. To find the relevant setuid / setgid programs, run the following command for each local partition PART:
    $ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null
If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d` for each setuid / setgid program on the system, replacing the SETUID_PROG_PATH part with the full path of that setuid / setgid program in the list:
    -a always,exit -F path=SETUID_PROG_PATH -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules` for each setuid / setgid program on the system, replacing the SETUID_PROG_PATH part with the full path of that setuid / setgid program in the list:
    -a always,exit -F path=SETUID_PROG_PATH -F auid>=1000 -F auid!=unset -F key=privileged
| Ensure auditd Collects Information on the Use of Privileged Commands - at | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83765-8 | Ensure auditd Collects Information on the Use of Privileged Commands - chage | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83763-3 | Ensure auditd Collects Information on the Use of Privileged Commands - chsh | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83761-7 | Ensure auditd Collects Information on the Use of Privileged Commands - crontab | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83773-2 | Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-90262-7 | Ensure auditd Collects Information on the Use of Privileged Commands - kmod | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /usr/bin/kmod -p x -k modules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -w /usr/bin/kmod -p x -k modules
CCE-89564-9 | Ensure auditd Collects Information on the Use of Privileged Commands - mount | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
| Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83766-6 | Ensure auditd Collects Information on the Use of Privileged Commands - newgrp | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
| Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83767-4 | Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/pam_timestamp_check
    -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/pam_timestamp_check
    -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83781-5 | Ensure auditd Collects Information on the Use of Privileged Commands - passwd | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83769-0 | Ensure auditd Collects Information on the Use of Privileged Commands - postdrop | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83770-8 | Ensure auditd Collects Information on the Use of Privileged Commands - postqueue | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
| Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-90388-0 | Record Any Attempts to Run ssh-agent | At a minimum, the audit system should collect any execution attempt of the `ssh-agent` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh-agent
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh-agent
CCE-83776-5 | Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83771-6 | Ensure auditd Collects Information on the Use of Privileged Commands - su | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83780-7 | Ensure auditd Collects Information on the Use of Privileged Commands - sudo | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83764-1 | Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83762-5 | Ensure auditd Collects Information on the Use of Privileged Commands - umount | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83768-2 | Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-89481-6 | Ensure auditd Collects Information on the Use of Privileged Commands - unix_update | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83760-9 | Ensure auditd Collects Information on the Use of Privileged Commands - userhelper | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-87212-7 | Ensure auditd Collects Information on the Use of Privileged Commands - usermod | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
| Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
CCE-83840-9 | Record attempts to alter time through adjtimex | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
    -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules
CCE-83837-5 | Record Attempts to Alter Time Through clock_settime | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
    -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules
CCE-83836-7 | Record attempts to alter time through settimeofday | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
    -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules
CCE-83835-9 | Record Attempts to Alter Time Through stime | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d` for both 32 bit and 64 bit systems:
    -a always,exit -F arch=b32 -S stime -F key=audit_time_rules
Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file for both 32 bit and 64 bit systems:
    -a always,exit -F arch=b32 -S stime -F key=audit_time_rules
Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined system calls:
    -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules
CCE-83839-1 | Record Attempts to Alter the localtime File | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /etc/localtime -p wa -k audit_time_rules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -w /etc/localtime -p wa -k audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used.
| Configure audispd Plugin To Send Logs To Remote Server | Configure the audispd plugin to off-load audit records onto a different system or media from the system being audited. Set the `remote_server` option in
    /etc/audisp/audisp-remote.conf
with an IP address or hostname of the system that the audispd plugin should send audit records to. For example
    remote_server =
CCE-88173-0 | Configure a Sufficiently Large Partition for Audit Logs | The Red Hat Enterprise Linux 9 operating system must allocate audit record storage capacity to store at least one weeks worth of audit records when audit records are not immediately sent to a central audit record storage facility. The partition size needed to capture a week's worth of audit records is based on the activity level of the system and the total storage capacity available. In normal circumstances, 10.0 GB of storage space for audit records will be sufficient. Determine which partition the audit records are being written to with the following command:
    # grep log_file /etc/audit/auditd.conf
    log_file = /var/log/audit/audit.log
Check the size of the partition that audit records are written to with the following command:
    # df -h /var/log/audit/
    /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit
| Configure audispd's Plugin disk_full_action When Disk Is Full | Configure the action the operating system takes if the disk the audit records are written to becomes full. Edit the file `/etc/audisp/audisp-remote.conf`. Add or modify the following line, substituting ACTION appropriately:
    disk_full_action = ACTION
Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `syslog` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined.
| Encrypt Audit Records Sent With audispd Plugin | Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited. Uncomment the `enable_krb5` option in
    /etc/audisp/audisp-remote.conf
, and set it with the following line:
    enable_krb5 = yes
| Configure audispd's Plugin network_failure_action On Network Failure | Configure the action the operating system takes if there is an error sending audit records to a remote system. Edit the file `/etc/audisp/audisp-remote.conf`. Add or modify the following line, substituting ACTION appropriately:
    network_failure_action = ACTION
Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `syslog` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. This profile configures the action to be ``.
CCE-83695-7 | Configure auditd to use audispd's syslog plugin | To configure the `auditd` service to use the `syslog` plug-in of the `audispd` audit event multiplexor, set the `active` line in `/etc/audit/plugins.d/syslog.conf` to `yes`. Restart the `auditd` service:
    $ sudo service auditd restart
CCE-83690-8 | Configure auditd Disk Error Action on Disk Error | The `auditd` service can be configured to take an action when there is a disk error. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately:
    disk_error_action = ACTION
Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `exec`, `single`, and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.
CCE-83684-1 | Configure auditd Disk Full Action when Disk Space Is Full | The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately:
    disk_full_action = ACTION
Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `exec`, `single`, and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.
CCE-83698-1 | Configure auditd mail_acct Action on Low Disk Space | The `auditd` service can be configured to send email to a designated account in certain situations. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that administrators are notified via email for those situations:
    action_mail_acct =
CCE-83700-5 | Configure auditd admin_space_left Action on Low Disk Space | The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately:
    admin_space_left_action = ACTION
Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `suspend` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.
CCE-83685-8 | Configure auditd flush priority | The `auditd` service can be configured to synchronously write audit event data to disk. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that audit event data is fully synchronized with the log files on the disk:
    flush =
CCE-83683-3 | Configure auditd Max Log File Size | Determine the amount of audit data (in megabytes) which should be retained in each log file. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting the correct value of for STOREMB:
    max_log_file = STOREMB
Set the value to `6` (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data.
CCE-83701-3 | Configure auditd max_log_file_action Upon Reaching Maximum Log Size | The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by `auditd`, add or correct the line in `/etc/audit/auditd.conf`:
    max_log_file_action = ACTION
Possible values for ACTION are described in the `auditd.conf` man page. These include: `ignore` `syslog` `suspend` `rotate` `keep_logs` Set the `ACTION` to `rotate` to ensure log rotation occurs. This is the default. The setting is case-insensitive.
CCE-83688-2 | Configure auditd Number of Logs Retained | Determine how many log files `auditd` should retain when it rotates logs. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting NUMLOGS with the correct value of :
    num_logs = NUMLOGS
Set the value to 5 for general-purpose systems. Note that values less than 2 result in no log rotation.
| Configure auditd space_left on Low Disk Space | The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting SIZE_in_MB appropriately:
    space_left = SIZE_in_MB
Set this value to the appropriate size in Megabytes cause the system to notify the user of an issue.
CCE-83703-9 | Configure auditd space_left Action on Low Disk Space | The `auditd` service can be configured to take an action when disk space starts to run low. Edit the file `/etc/audit/auditd.conf`. Modify the following line, substituting ACTION appropriately:
    space_left_action = ACTION
Possible values for ACTION are described in the `auditd.conf` man page. These include: `syslog` `email` `exec` `suspend` `single` `halt` Set this to `email` (instead of the default, which is `suspend`) as it is more likely to get prompt attention. Acceptable values also include `suspend`, `single`, and `halt`.
CCE-87746-4 | Configure auditd space_left on Low Disk Space | The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting PERCENTAGE appropriately:
    space_left = PERCENTAGE%
Set this value to at least 25 to cause the system to notify the user of an issue.
CCE-83704-7 | Set number of records to cause an explicit flush to audit logs | To configure Audit daemon to issue an explicit flush to disk command after writing 50 records, set `freq` to `50` in `/etc/audit/auditd.conf`.
CCE-83682-5 | Include Local Events in Audit Logs | To configure Audit daemon to include local events in Audit logs, set `local_events` to `yes` in `/etc/audit/auditd.conf`. This is the default setting.
CCE-83696-5 | Resolve information before writing to audit logs | To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set `log_format` to `ENRICHED` in `/etc/audit/auditd.conf`.
CCE-83686-6 | Set hostname as computer node name in audit logs | To configure Audit daemon to use value returned by gethostname syscall as computer node name in the audit events, set `name_format` to `hostname` in `/etc/audit/auditd.conf`.
CCE-87901-5 | Appropriate Action Must be Setup When the Internal Audit Event Queue is Full | The audit system should have an action setup in the event the internal event queue becomes full. To setup an overflow action edit `/etc/audit/auditd.conf`. Set `overflow_action` to one of the following values: `syslog`, `single`, `halt`.
CCE-83705-4 | Write Audit Logs to the Disk | To configure Audit daemon to write Audit logs to the disk, set `write_logs` to `yes` in `/etc/audit/auditd.conf`. This is the default setting.
CCE-83672-6 | Configure auditing of unsuccessful file accesses | Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above:
    ## Unsuccessful file access (any other opens) This has to go last.
    -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
    -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
    -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
    -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83653-6 | Configure auditing of successful file accesses | Ensure that successful attempts to access a file are audited. The following rules configure audit as described above:
    ## Successful file access (any other opens) This has to go last.
    ## These next two are likely to result in a whole lot of events
    -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
    -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83670-0 | Configure basic parameters of Audit system | Perform basic configuration of Audit system. Make sure that any previously defined rules are cleared, the auditing system is configured to handle sudden bursts of events, and in cases of failure, messages are configured to be directed to system log. The following rules configure audit as described above:
    ## First rule - delete all
    -D

    ## Increase the buffers to survive stress events.
    ## Make this bigger for busy systems
    -b 8192

    ## This determine how long to wait in burst of events
    --backlog_wait_time 60000

    ## Set failure mode to syslog
    -f 1
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/10-base-config.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/10-base-config.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
CCE-83669-2 | Configure auditing of unsuccessful file creations | Ensure that unsuccessful attempts to create a file are audited. The following rules configure audit as described above:
    ## Unsuccessful file creation (open with O_CREAT)
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83668-4 | Configure auditing of successful file creations | Ensure that successful attempts to create a file are audited. The following rules configure audit as described above:
    ## Successful file creation (open with O_CREAT)
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
CCE-83667-6 | Configure auditing of unsuccessful file deletions | Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above:
    ## Unsuccessful file delete
    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83680-9 | Configure auditing of successful file deletions | Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above:
    ## Successful file delete
    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83673-4 | Configure immutable Audit login UIDs | Configure kernel to prevent modification of login UIDs once they are set. Changing login UIDs while this configuration is enforced requires special capabilities which are not available to unprivileged users. The following rules configure audit as described above:
    ## Make the loginuid immutable. This prevents tampering with the auid.
    --loginuid-immutable
The `Audit` provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/11-loginuid.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/11-loginuid.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
CCE-83671-8 | Configure auditing of unsuccessful file modifications | Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above:
    ## Unsuccessful file modifications (open for write or truncate)
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83681-7 | Configure auditing of successful file modifications | Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above:
    ## Successful file modifications (open for write or truncate)
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-90814-5 | Configure auditing of loading and unloading of kernel modules | Ensure that loading and unloading of kernel modules is audited. The following rules configure audit as described above:
    ## These rules watch for kernel module insertion. By monitoring
    ## the syscall, we do not need any watches on programs.
    -a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
    -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
    -a always,exit -F arch=b32 -S delete_module -F key=module-unload
    -a always,exit -F arch=b64 -S delete_module -F key=module-unload
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/43-module-load.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/43-module-load.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
CCE-83655-1 | Perform general configuration of Audit for OSPP | Configure some basic `Audit` parameters specific for OSPP profile. In particular, configure `Audit` to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration. Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls. The following rules configure audit as described above:
    ## The purpose of these rules is to meet the requirements for Operating
    ## System Protection Profile (OSPP)v4.2. These rules depends on having
    ## the following rule files copied to /etc/audit/rules.d:
    ##
    ## 10-base-config.rules, 11-loginuid.rules,
    ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
    ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
    ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
    ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
    ## 30-ospp-v42-5-perm-change-failed.rules,
    ## 30-ospp-v42-5-perm-change-success.rules,
    ## 30-ospp-v42-6-owner-change-failed.rules,
    ## 30-ospp-v42-6-owner-change-success.rules
    ##
    ## original copies may be found in /usr/share/audit/sample-rules/

    ## User add delete modify. This is covered by pam. However, someone could
    ## open a file and directly create or modify a user, so we'll watch passwd and
    ## shadow for writes
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

    ## User enable and disable. This is entirely handled by pam.

    ## Group add delete modify. This is covered by pam. However, someone could
    ## open a file and directly create or modify a user, so we'll watch group and
    ## gshadow for writes
    -a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify
    -a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify

    ## Use of special rights for config changes. This would be use of setuid
    ## programs that relate to user accts. This is not all setuid apps because
    ## requirements are only for ones that affect system configuration.
    -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes

    ## Privilege escalation via su or sudo. This is entirely handled by pam.

    ## Watch for configuration changes to privilege escalation.
    -a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
    -a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes

    ## Audit log access
    -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
    ## Attempts to Alter Process and Session Initiation Information
    -a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
    -a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
    -a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session

    ## Attempts to modify MAC controls
    -a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy

    ## Software updates. This is entirely handled by rpm.

    ## System start and shutdown. This is entirely handled by systemd

    ## Kernel Module loading. This is handled in 43-module-load.rules

    ## Application invocation. The requirements list an optional requirement
    ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
    ## state results from that policy. This would be handled entirely by
    ## that daemon.
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83675-9 | Configure auditing of unsuccessful ownership changes | Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above:
    ## Unsuccessful ownership change
    -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change
    -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change
    -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change
    -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83658-5 | Configure auditing of successful ownership changes | Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above:
    ## Successful ownership change
    -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change
    -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules /etc/audit/rules.d/
The file has the following SHA-256 checksum:
    7eb41a6aaf6737c2571b6424fae7fa53af4b41a9115b6c5732a5778ccd9900ad
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83676-7 | Configure auditing of unsuccessful permission changes | Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above:
    ## Unsuccessful permission change
    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change
    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change
    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change
    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
CCE-83678-3 | Configure auditing of successful permission changes | Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above:
    ## Successful permission change
    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.
| Configure audit according to OSPP requirements | Configure audit to meet requirements for Operating System Protection Profile (OSPP) v4.2.1. Audit defines groups of rules in `/usr/share/doc/audit/rules` to satisfy specific policies. To fulfill requirements for compliance with OSPP v4.2.1, the following files are necessary: /usr/share/doc/audit/rules/10-base-config.rules /usr/share/doc/audit/rules/11-loginuid.rules /usr/share/doc/audit/rules/30-ospp-v42.rules /usr/share/doc/audit/rules/43-module-load.rules Copy the files from `/usr/share/doc/audit/rules` to `/etc/audit/rules.d`:
    cp /usr/share/doc/audit*/rules/{10-base-config,11-loginuid,30-ospp-v42,43-module-load}.rules /etc/audit/rules.d/
CCE-83844-1 | IOMMU configuration directive | On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some of the system critical units such as the memory. To ensure that `iommu=force` is added as a kernel command line argument to newly installed kernels, ad `iommu=force` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... iommu=force ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="iommu=force"
CCE-85867-0 | Configure kernel to zero out memory before allocation | To configure the kernel to zero out memory before allocating it, add the `init_on_alloc=1` argument to the default GRUB 2 command line. To ensure that `init_on_alloc=1` is added as a kernel command line argument to newly installed kernels, ad `init_on_alloc=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... init_on_alloc=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="init_on_alloc=1"
CCE-83841-7 | Configure kernel to trust the CPU random number generator | There exist two ways how to ensure that the Linux kernel trusts the CPU hardware random number generator. If the option is configured during kernel compilation, e.g. the option `CONFIG_RANDOM_TRUST_CPU` is set to `Y`, make sure that it is not overridden with the boot parameter. There must not exist the boot parameter `random.trust_cpu=off`. If the option is not compiled in, make sure that `random.trust_cpu=on` is configured as a boot parameter. To ensure that `random.trust_cpu=on` is added as a kernel command line argument to newly installed kernels, ad `random.trust_cpu=on` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... random.trust_cpu=on ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="random.trust_cpu=on"
CCE-88098-9 | Force kernel panic on uncorrected MCEs | A Machine Check Exception is an error generated by the CPU itdetects an error in itself, memory or I/O devices. These errors may be corrected and generate a check log entry, if an error cannot be corrected the kernel may panic or SIGBUS. To force the kernel to panic on any uncorrected error reported by Machine Check set the MCE tolerance to zero by adding `mce=0` to the default GRUB 2 command line for the Linux operating system. To ensure that `mce=0` is added as a kernel command line argument to newly installed kernels, ad `mce=0` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... mce=0 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="mce=0"
CCE-88345-4 | Ensure SMAP is not disabled during boot | The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into memory pages in the user space, it is enabled by default since Linux kernel 3.7. But it could be disabled through kernel boot parameters. Ensure that Supervisor Mode Access Prevention (SMAP) is not disabled by the `nosmap` boot paramenter option. Check that the line
    GRUB_CMDLINE_LINUX="..."
within `/etc/default/grub` doesn't contain the argument `nosmap`. Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --remove-args="nosmap"
CCE-86089-0 | Ensure SMEP is not disabled during boot | The SMEP is used to prevent the supervisor mode from executing user space code, it is enabled by default since Linux kernel 3.0. But it could be disabled through kernel boot parameters. Ensure that Supervisor Mode Execution Prevention (SMEP) is not disabled by the `nosmep` boot paramenter option. Check that the line
    GRUB_CMDLINE_LINUX="..."
within `/etc/default/grub` doesn't contain the argument `nosmep`. Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --remove-args="nosmep"
CCE-85879-5 | Enable randomization of the page allocator | To enable randomization of the page allocator in the kernel, add the `page_alloc.shuffle=1` argument to the default GRUB 2 command line. To ensure that `page_alloc.shuffle=1` is added as a kernel command line argument to newly installed kernels, ad `page_alloc.shuffle=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... page_alloc.shuffle=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="page_alloc.shuffle=1"
CCE-83843-3 | Enable Kernel Page-Table Isolation (KPTI) | To enable Kernel page-table isolation, add the argument `pti=on` to the default GRUB 2 command line for the Linux operating system. To ensure that `pti=on` is added as a kernel command line argument to newly installed kernels, ad `pti=on` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... pti=on ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="pti=on"
CCE-87770-4 | Disable merging of slabs with similar size | The kernel may merge similar slabs together to reduce overhead and increase cache hotness of objects. Disabling merging of slabs keeps the slabs separate and reduces the risk of kernel heap overflows overwriting objects in merged caches. To disable merging of slabs in the Kernel add the argument `slab_nomerge=yes` to the default GRUB 2 command line for the Linux operating system. To ensure that `slab_nomerge=yes` is added as a kernel command line argument to newly installed kernels, ad `slab_nomerge=yes` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... slab_nomerge=yes ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="slab_nomerge=yes"
CCE-83842-5 | Disable vsyscalls | To disable use of virtual syscalls, add the argument `vsyscall=none` to the default GRUB 2 command line for the Linux operating system. To ensure that `vsyscall=none` is added as a kernel command line argument to newly installed kernels, ad `vsyscall=none` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... vsyscall=none ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="vsyscall=none"
CCE-83848-2 | Verify /boot/grub2/grub.cfg Group Ownership | The file `/boot/grub2/grub.cfg` should be group-owned by the `root` group to prevent destruction or modification of the file. To properly set the group owner of `/boot/grub2/grub.cfg`, run the command:
    $ sudo chgrp root /boot/grub2/grub.cfg
CCE-83845-8 | Verify /boot/grub2/grub.cfg User Ownership | The file `/boot/grub2/grub.cfg` should be owned by the `root` user to prevent destruction or modification of the file. To properly set the owner of `/boot/grub2/grub.cfg`, run the command:
    $ sudo chown root /boot/grub2/grub.cfg
CCE-83846-6 | Verify /boot/grub2/grub.cfg Permissions | File permissions for `/boot/grub2/grub.cfg` should be set to 600. To properly set the permissions of `/boot/grub2/grub.cfg`, run the command:
    $ sudo chmod 600 /boot/grub2/grub.cfg
CCE-87370-3 | Set the Boot Loader Admin Username to a Non-Default Value | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. To maximize the protection, select a password-protected superuser account with unique name, and modify the `/etc/grub.d/01_users` configuration file to reflect the account name change. Do not to use common administrator account names like root, admin, or administrator for the grub2 superuser account. Change the superuser to a different username (The default is 'root').
    $ sed -i 's/\(set superuser=\).*/\1"<unique user ID>"/g' /etc/grub.d/01_users
Once the superuser account has been added, update the `grub.cfg` file by running:
    grub2-mkconfig -o /boot/grub2/grub.cfg
CCE-83849-0 | Set Boot Loader Password in grub2 | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command:
    # grub2-setpassword
When prompted, enter the password that was selected.
CCE-85925-6 | Verify the UEFI Boot Loader grub.cfg Permissions | File permissions for `/boot/efi/EFI/redhat/grub.cfg` should be set to 700. To properly set the permissions of `/boot/efi/EFI/redhat/grub.cfg`, run the command:
    $ sudo chmod 700 /boot/efi/EFI/redhat/grub.cfg
CCE-89427-9 | Set the UEFI Boot Loader Admin Username to a Non-Default Value | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. To maximize the protection, select a password-protected superuser account with unique name, and modify the `/etc/grub.d/01_users` configuration file to reflect the account name change. It is highly suggested not to use common administrator account names like root, admin, or administrator for the grub2 superuser account. Change the superuser to a different username (The default is 'root').
    $ sed -i 's/\(set superuser=\).*/\1"<unique user ID>"/g' /etc/grub.d/01_users
Once the superuser account has been added, update the `grub.cfg` file by running:
    grub2-mkconfig -o /boot/grub2/grub.cfg
CCE-88654-9 | Set the UEFI Boot Loader Password | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command:
    # grub2-setpassword
When prompted, enter the password that was selected.
CCE-84096-7 | Enable Auditing to Start Prior to the Audit Daemon in zIPL | To ensure all processes can be audited, even those which start prior to the audit daemon, check that all boot entries in `/boot/loader/entries/*.conf` have `audit=1` included in its options. To ensure that new kernels and boot entries continue to enable audit, add `audit=1` to `/etc/kernel/cmdline`.
CCE-84099-1 | Extend Audit Backlog Limit for the Audit Daemon in zIPL | To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon, check that all boot entries in `/boot/loader/entries/*.conf` have `audit_backlog_limit=8192` included in its options. To ensure that new kernels and boot entries continue to extend the audit log events queue, add `audit_backlog_limit=8192` to `/etc/kernel/cmdline`.
CCE-84092-6 | Ensure all zIPL boot entries are BLS compliant | Ensure that zIPL boot entries fully adheres to Boot Loader Specification (BLS) by checking that `/etc/zipl.conf` doesn't contain `image =` .
CCE-84098-3 | Ensure zIPL bootmap is up to date | Make sure that `/boot/bootmap` is up to date. Every time a boot entry or zIPL configuration is changed `/boot/bootmap` needs to be updated to reflect the changes. Run `zipl` command to generate an updated `/boot/bootmap`.
| Ensure SELinux Not Disabled in zIPL | To ensure SELinux is not disabled at boot time, check that no boot entry in `/boot/loader/entries/*.conf` has `selinux=0` included in its options.
CCE-85868-8 | Configure kernel to zero out memory before allocation in zIPL | To ensure that the kernel is configured to zero out memory before allocation, check that all boot entries in `/boot/loader/entries/*.conf` have `init_on_alloc=1` included in its options. To ensure that new kernels and boot entries continue to zero out memory before allocation, add `init_on_alloc=1` to `/etc/kernel/cmdline`.
CCE-85880-3 | Enable randomization of the page allocator in zIPL | To enable the randomization of the page allocator in the kernel, check that all boot entries in `/boot/loader/entries/*.conf` have `page_alloc.shuffle=1` included in its options. To enable randomization of the page allocator also for newly installed kernels, add `page_alloc.shuffle=1` to `/etc/kernel/cmdline`.
CCE-84101-5 | Enable page allocator poisoning in zIPL | To enable poisoning of free pages, check that all boot entries in `/boot/loader/entries/*.conf` have `page_poison=1` included in its options. To ensure that new kernels and boot entries continue to enable page poisoning, add `page_poison=1` to `/etc/kernel/cmdline`.
CCE-84094-2 | Enable SLUB/SLAB allocator poisoning in zIPL | To enable poisoning of SLUB/SLAB objects, check that all boot entries in `/boot/loader/entries/*.conf` have `slub_debug=P` included in its options. To ensure that new kernels and boot entries continue to enable poisoning of SLUB/SLAB objects, add `slub_debug=P` to `/etc/kernel/cmdline`.
CCE-84100-7 | Disable vsyscalls in zIPL | To disable use of virtual syscalls, check that all boot entries in `/boot/loader/entries/*.conf` have `vsyscall=none` included in its options. To ensure that new kernels and boot entries continue to disable virtual syscalls, add `vsyscall=none` to `/etc/kernel/cmdline`.
| Ensure Solid State Drives Do Not Contribute To Random-Number Entropy Pool | For each solid-state drive on the system, run:
     # echo 0 > /sys/block/DRIVE/queue/add_random
CCE-83987-8 | Ensure rsyslog-gnutls is installed | TLS protocol support for rsyslog is installed. The `rsyslog-gnutls` package can be installed with the following command:
    $ sudo dnf install rsyslog-gnutls
CCE-84063-7 | Ensure rsyslog is Installed | Rsyslog is installed by default. The `rsyslog` package can be installed with the following command:
     $ sudo dnf install rsyslog
CCE-83989-4 | Enable rsyslog Service | The `rsyslog` service provides syslog-style logging by default on Red Hat Enterprise Linux 9. The `rsyslog` service can be enabled with the following command:
    $ sudo systemctl enable rsyslog.service
CCE-83994-4 | Ensure cron Is Logging To Rsyslog | Cron logging must be implemented to spot intrusions or trace cron job status. If `cron` is not logging to `rsyslog`, it can be implemented by adding the following to the RULES section of `/etc/rsyslog.conf`:
    cron.*                                                  /var/log/cron
CCE-86871-1 | Ensure Rsyslog Authenticates Off-Loaded Audit Records | Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs the remote system must be authenticated.
CCE-90191-8 | Ensure Rsyslog Encrypts Off-Loaded Audit Records | Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs off a encrpytion system must be used.
CCE-86782-0 | Ensure Rsyslog Encrypts Off-Loaded Audit Records | Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs off a encrpytion system must be used.
CCE-83834-2 | Ensure Log Files Are Owned By Appropriate Group | The group-owner of all log files written by `rsyslog` should be ``. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's group owner:
    $ ls -l LOGFILE
If the owner is not ``, run the following command to correct this:
    $ sudo chgrp  LOGFILE
CCE-83946-4 | Ensure Log Files Are Owned By Appropriate User | The owner of all log files written by `rsyslog` should be ``. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's owner:
    $ ls -l LOGFILE
If the owner is not ``, run the following command to correct this:
    $ sudo chown  LOGFILE
CCE-83689-0 | Ensure System Log Files Have Correct Permissions | The file permissions for all log files written by `rsyslog` should be set to 600, or more restrictive. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's permissions:
    $ ls -l LOGFILE
If the permissions are not 600 or more restrictive, run the following command to correct this:
    $ sudo chmod 0600 LOGFILE
"
CCE-87960-1 | Ensure remote access methods are monitored in Rsyslog | Logging of remote access methods must be implemented to help identify cyber attacks and ensure ongoing compliance with remote access policies are being audited and upheld. An examples of a remote access method is the use of the Remote Desktop Protocol (RDP) from an external, non-organization controlled network. The `/etc/rsyslog.conf` or `/etc/rsyslog.d/*.conf` file should contain a match for the following selectors: `auth.*`, `authpriv.*`, and `daemon.*`. If not, use the following as an example configuration:
    auth.*;authpriv.*;daemon.*                              /var/log/secure
CCE-85931-4 | Ensure journald is configured to compress large log files | The journald system can compress large log files to avoid fill the system disk.
CCE-85996-7 | Ensure journald is configured to send logs to rsyslog | Data from journald may be stored in volatile memory or persisted locally. Utilities exist to accept remote export of journald logs.
CCE-86046-0 | Ensure journald is configured to write log files to persistent disk | The journald system may store log files in volatile memory or locally on disk. If the logs are only stored in volatile memory they will we lost upon reboot.
CCE-83993-6 | Ensure Logrotate Runs Periodically | The `logrotate` utility allows for the automatic rotation of log files. The frequency of rotation is specified in `/etc/logrotate.conf`, which triggers a cron task. To configure logrotate to run daily, add or correct the following line in `/etc/logrotate.conf`:
    # rotate log files frequency
    daily
| Ensure syslog-ng is Installed | syslog-ng can be installed in replacement of rsyslog. The `syslog-ng-core` package can be installed with the following command:
    $ sudo dnf install syslog-ng-core
| Enable syslog-ng Service | The `syslog-ng` service (in replacement of rsyslog) provides syslog-style logging by default on Debian. The `syslog-ng` service can be enabled with the following command:
    $ sudo systemctl enable syslog-ng.service
| Enable rsyslog to Accept Messages via TCP, if Acting As Log Server | The `rsyslog` daemon should not accept remote messages unless the system acts as a log server. If the system needs to act as a central log server, add the following lines to `/etc/rsyslog.conf` to enable reception of messages over TCP:
    $ModLoad imtcp
    $InputTCPServerRun 514
| Enable rsyslog to Accept Messages via UDP, if Acting As Log Server | The `rsyslog` daemon should not accept remote messages unless the system acts as a log server. If the system needs to act as a central log server, add the following lines to `/etc/rsyslog.conf` to enable reception of messages over UDP:
    $ModLoad imudp
    $UDPServerRun 514
CCE-83995-1 | Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server | The `rsyslog` daemon should not accept remote messages unless the system acts as a log server. To ensure that it is not listening on the network, ensure the following lines are not found in `/etc/rsyslog.conf`:
    $ModLoad imtcp
    $InputTCPServerRun port
    $ModLoad imudp
    $UDPServerRun port
    $ModLoad imrelp
    $InputRELPServerRun port
CCE-83990-2 | Ensure Logs Sent To Remote Host | To configure rsyslog to send logs to a remote log server, open `/etc/rsyslog.conf` and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting `` appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments. To use UDP for log message delivery:
    *.* @
To use TCP for log message delivery:
    *.* @@
To use RELP for log message delivery:
    *.* :omrelp:
There must be a resolvable DNS CNAME or Alias record set to "" for logs to be sent correctly to the centralized logging utility.
CCE-83991-0 | Configure TLS for rsyslog remote logging | Configure `rsyslog` to use Transport Layer Security (TLS) support for logging to remote server for the Forwarding Output Module in `/etc/rsyslog.conf` using action. You can use the following command:
    echo 'action(type="omfwd" protocol="tcp" Target="<remote system>" port="6514"
        StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' >> /etc/rsyslog.conf
Replace the `<remote system>` in the above command with an IP address or a host name of the remote logging server.
CCE-83992-8 | Configure CA certificate for rsyslog remote logging | Configure CA certificate for `rsyslog` logging to remote server using Transport Layer Security (TLS) using correct path for the `DefaultNetstreamDriverCAFile` global option in `/etc/rsyslog.conf`, for example with the following command:
    echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' >> /etc/rsyslog.conf
Replace the `/etc/pki/tls/cert.pem` in the above command with the path to the file with CA certificate generated for the purpose of remote logging.
CCE-86858-8 | Configure Multiple DNS Servers in /etc/resolv.conf | Multiple Domain Name System (DNS) Servers should be configured in `/etc/resolv.conf`. This provides redundant name resolution services in the event that a domain server crashes. To configure the system to contain as least `2` DNS servers, add a corresponding `nameserver ip_address` entry in `/etc/resolv.conf` for each DNS server where ip_address is the IP address of a valid DNS server. For example:
    search example.com
    nameserver 192.168.0.1
    nameserver 192.168.0.2
CCE-90061-3 | Prevent non-Privileged Users from Modifying Network Interfaces using nmcli | By default, non-privileged users are given permissions to modify networking interfaces and configurations using the `nmcli` command. Non-privileged users should not be making configuration changes to network configurations. To ensure that non-privileged users do not have permissions to make changes to the network configuration using `nmcli`, create the following configuration in `/etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla`:
    [Disable General User Access to NetworkManager]
    Identity=default
    Action=org.freedesktop.NetworkManager.*
    ResultAny=no
    ResultInactive=no
    ResultActive=auth_admin
CCE-83996-9 | Ensure System is Not Acting as a Network Sniffer | The system should not be acting as a network sniffer, which can capture all traffic on the network to which it is connected. Run the following to determine if any interface is running in promiscuous mode:
    $ ip link | grep PROMISC
Promiscuous mode of an interface can be disabled with the following command:
    $ sudo ip link set dev device_name multicast off promisc off
CCE-84021-5 | Install firewalld Package | The `firewalld` package can be installed with the following command:
    $ sudo dnf install firewalld
CCE-90833-5 | Verify firewalld Enabled | The `firewalld` service can be enabled with the following command:
    $ sudo systemctl enable firewalld.service
CCE-86041-1 | Configure the Firewalld Ports | Configure the `firewalld` ports to allow approved services to have access to the system. To configure `firewalld` to open ports, run the following command:
    $ sudo firewall-cmd --permanent --add-port=port_number/tcp
or
    $ sudo firewall-cmd --permanent --add-port=service_name
Run the command list above for each of the ports listed below: To configure `firewalld` to allow access, run the following command(s): `firewall-cmd --permanent --add-service=ssh`
CCE-84023-1 | Set Default firewalld Zone for Incoming Packets | To set the default zone to `drop` for the built-in default zone which processes incoming IPv4 and IPv6 packets, modify the following line in `/etc/firewalld/firewalld.conf` to be:
    DefaultZone=drop
CCE-84068-6 | Install libreswan Package | The Libreswan package provides an implementation of IPsec and IKE, which permits the creation of secure tunnels over untrusted networks. The `libreswan` package can be installed with the following command:
    $ sudo dnf install libreswan
CCE-90319-5 | Verify Any Configured IPSec Tunnel Connections | Libreswan provides an implementation of IPsec and IKE, which permits the creation of secure tunnels over untrusted networks. As such, IPsec can be used to circumvent certain network requirements such as filtering. Verify that if any IPsec connection (`conn`) configured in `/etc/ipsec.conf` and `/etc/ipsec.d` exists is an approved organizational connection.
| Verify ip6tables Enabled if Using IPv6 | The `ip6tables` service can be enabled with the following command:
    $ sudo systemctl enable ip6tables.service
| Verify iptables Enabled | The `iptables` service can be enabled with the following command:
    $ sudo systemctl enable iptables.service
| Set Default ip6tables Policy for Incoming Packets | To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in `/etc/sysconfig/ip6tables`:
    :INPUT DROP [0:0]
If changes were required, reload the ip6tables rules:
    $ sudo service ip6tables reload
| Set Default iptables Policy for Incoming Packets | To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in `/etc/sysconfig/iptables`:
    :INPUT DROP [0:0]
| Set Default iptables Policy for Forwarded Packets | To set the default policy to DROP (instead of ACCEPT) for the built-in FORWARD chain which processes packets that will be forwarded from one interface to another, add or correct the following line in `/etc/sysconfig/iptables`:
    :FORWARD DROP [0:0]
| Ensure IPv6 is disabled through kernel boot parameter | To disable IPv6 protocol support in the Linux kernel, add the argument `ipv6.disable=1` to the default GRUB2 command line for the Linux operating system. To ensure that `ipv6.disable=1` is added as a kernel command line argument to newly installed kernels, ad `ipv6.disable=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... ipv6.disable=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="ipv6.disable=1"
CCE-84024-9 | Disable IPv6 Networking Support Automatic Loading | To prevent the IPv6 kernel module (`ipv6`) from binding to the IPv6 networking stack, add the following line to `/etc/modprobe.d/disabled.conf` (or another file in `/etc/modprobe.d`):
    options ipv6 disable=1
This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it), while disabling support for the IPv6 protocol.
| Disable IPv6 Addressing on All IPv6 Interfaces | To disable support for (`ipv6`) addressing on all interface add the following line to `/etc/sysctl.d/ipv6.conf` (or another file in `/etc/sysctl.d`):
    net.ipv6.conf.all.disable_ipv6 = 1
This disables IPv6 on all network interfaces as other services and system functionality require the IPv6 stack loaded to work.
| Disable IPv6 Addressing on IPv6 Interfaces by Default | To disable support for (`ipv6`) addressing on interfaces by default add the following line to `/etc/sysctl.d/ipv6.conf` (or another file in `/etc/sysctl.d`):
    net.ipv6.conf.default.disable_ipv6 = 1
This disables IPv6 on network interfaces by default as other services and system functionality require the IPv6 stack loaded to work.
CCE-84120-5 | Configure Accepting Router Advertisements on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_ra` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_ra = 0
CCE-84115-5 | Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_ra_defrtr` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_ra_defrtr=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_ra_defrtr = 0
CCE-84122-1 | Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_ra_pinfo` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_ra_pinfo=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_ra_pinfo = 0
CCE-84111-4 | Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_ra_rtr_pref` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_ra_rtr_pref=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_ra_rtr_pref = 0
CCE-84125-4 | Disable Accepting ICMP Redirects for All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_redirects = 0
CCE-84131-2 | Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_source_route = 0
CCE-84126-2 | Configure Auto Configuration on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.autoconf` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.autoconf=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.autoconf = 0
CCE-84114-8 | Disable Kernel Parameter for IPv6 Forwarding | To set the runtime status of the `net.ipv6.conf.all.forwarding` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.forwarding=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.forwarding = 0
CCE-84112-2 | Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.max_addresses` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.max_addresses=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.max_addresses = 1
CCE-84128-8 | Configure Denying Router Solicitations on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.router_solicitations` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.router_solicitations=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.router_solicitations = 0
CCE-84124-7 | Disable Accepting Router Advertisements on all IPv6 Interfaces by Default | To set the runtime status of the `net.ipv6.conf.default.accept_ra` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_ra = 0
CCE-84116-3 | Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default | To set the runtime status of the `net.ipv6.conf.default.accept_ra_defrtr` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_ra_defrtr=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_ra_defrtr = 0
CCE-84118-9 | Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default | To set the runtime status of the `net.ipv6.conf.default.accept_ra_pinfo` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_ra_pinfo=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_ra_pinfo = 0
CCE-84121-3 | Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default | To set the runtime status of the `net.ipv6.conf.default.accept_ra_rtr_pref` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_ra_rtr_pref=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_ra_rtr_pref = 0
CCE-84113-0 | Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.default.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_redirects = 0
CCE-84130-4 | Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default | To set the runtime status of the `net.ipv6.conf.default.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_source_route = 0
CCE-84133-8 | Configure Auto Configuration on All IPv6 Interfaces By Default | To set the runtime status of the `net.ipv6.conf.default.autoconf` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.autoconf=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.autoconf = 0
CCE-84117-1 | Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default | To set the runtime status of the `net.ipv6.conf.default.max_addresses` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.max_addresses=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.max_addresses = 1
CCE-84026-4 | Configure Denying Router Solicitations on All IPv6 Interfaces By Default | To set the runtime status of the `net.ipv6.conf.default.router_solicitations` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.router_solicitations=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.router_solicitations = 0
CCE-84011-6 | Disable Accepting ICMP Redirects for All IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.accept_redirects = 0
CCE-84001-7 | Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.accept_source_route = 0
CCE-84000-9 | Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.log_martians` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.log_martians=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.log_martians = 1
CCE-84008-2 | Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.rp_filter` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.rp_filter = 1
CCE-84016-5 | Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.secure_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.secure_redirects = 0
CCE-84003-3 | Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.default.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.accept_redirects = 0
CCE-84007-4 | Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.accept_source_route = 0
CCE-84014-0 | Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.log_martians` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.log_martians=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.log_martians = 1
CCE-84009-0 | Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.rp_filter` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.rp_filter = 1
CCE-84019-9 | Configure Kernel Parameter for Accepting Secure Redirects By Default | To set the runtime status of the `net.ipv4.conf.default.secure_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.secure_redirects = 0
CCE-84004-1 | Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces | To set the runtime status of the `net.ipv4.icmp_echo_ignore_broadcasts` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.icmp_echo_ignore_broadcasts = 1
CCE-84015-7 | Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces | To set the runtime status of the `net.ipv4.icmp_ignore_bogus_error_responses` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.icmp_ignore_bogus_error_responses = 1
CCE-90834-3 | Set Kernel Parameter to Increase Local Port Range | To set the runtime status of the `net.ipv4.ip_local_port_range` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.ip_local_port_range=32768 65535
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.ip_local_port_range = 32768 65535
| Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments | Make sure that the system is configured to limit the maximal rate for sending duplicate acknowledgments in response to incoming TCP packets that are for an existing connection but that are invalid due to any of these reasons: (a) out-of-window sequence number, (b) out-of-window acknowledgment number, or (c) PAWS (Protection Against Wrapped Sequence numbers) check failure This measure protects against or limits effects of DoS attacks against the system. Set the system to implement rate-limiting measures by adding the following line to `/etc/sysctl.conf` or a configuration file in the `/etc/sysctl.d/` directory (or modify the line to have the required value):
    net.ipv4.tcp_invalid_ratelimit =
Issue the following command to make the changes take effect:
    # sysctl --system
CCE-84012-4 | Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces | To set the runtime status of the `net.ipv4.tcp_rfc1337` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.tcp_rfc1337=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.tcp_rfc1337 = 1
CCE-84006-6 | Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces | To set the runtime status of the `net.ipv4.tcp_syncookies` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.tcp_syncookies=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.tcp_syncookies = 1
CCE-83997-7 | Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.send_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.send_redirects = 0
CCE-83999-3 | Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.send_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.send_redirects = 0
CCE-83998-5 | Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces | To set the runtime status of the `net.ipv4.ip_forward` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.ip_forward=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.ip_forward = 0
CCE-84137-9 | Disable ATM Support | The Asynchronous Transfer Mode (ATM) is a protocol operating on network, data link, and physical layers, based on virtual circuits and virtual paths. To configure the system to prevent the `atm` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install atm /bin/true
CCE-84134-6 | Disable CAN Support | The Controller Area Network (CAN) is a serial communications protocol which was initially developed for automotive and is now also used in marine, industrial, and medical applications. To configure the system to prevent the `can` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install can /bin/true
CCE-84136-1 | Disable DCCP Support | The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the `dccp` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install dccp /bin/true
CCE-84060-3 | Disable IEEE 1394 (FireWire) Support | The IEEE 1394 (FireWire) is a serial bus standard for high-speed real-time communication. To configure the system to prevent the `firewire-core` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install firewire-core /bin/true
CCE-84064-5 | Disable RDS Support | The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high-bandwidth, low-latency communications between nodes in a cluster. To configure the system to prevent the `rds` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install rds /bin/true
CCE-84139-5 | Disable SCTP Support | The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the `sctp` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install sctp /bin/true
CCE-84065-2 | Disable TIPC Support | The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the `tipc` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install tipc /bin/true
CCE-84067-8 | Disable Bluetooth Kernel Module | The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate `/etc/modprobe.d` configuration file to prevent the loading of the Bluetooth module:
    install bluetooth /bin/true
CCE-84066-0 | Deactivate Wireless Network Interfaces | Deactivating wireless network interfaces should prevent normal usage of the wireless capability. Configure the system to disable all wireless network interfaces with the following command:
    $ sudo nmcli radio wifi off
CCE-83903-5 | Ensure All World-Writable Directories Are Owned by root user | All directories in local partitions which are world-writable should be owned by root. If any world-writable directories are not owned by root, this should be investigated. Following this, the files should be deleted or assigned to root user.
CCE-83895-3 | Verify that All World-Writable Directories Have Sticky Bits Set | When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes. To set the sticky bit on a world-writable directory DIR, run the following command:
    $ sudo chmod +t DIR
CCE-89284-4 | Verify Permissions on /etc/audit/auditd.conf | To properly set the permissions of `/etc/audit/auditd.conf`, run the command:
    $ sudo chmod 0640 /etc/audit/auditd.conf
CCE-89977-3 | Verify Permissions on /etc/audit/rules.d/*.rules | To properly set the permissions of `/etc/audit/rules.d/*.rules`, run the command:
    $ sudo chmod 0640 /etc/audit/rules.d/*.rules
| Verify that local System.map file (if exists) is readable only by root | Files containing sensitive informations should be protected by restrictive permissions. Most of the time, there is no need that these files need to be read by any non-root user To properly set the permissions of `/boot/System.map-*`, run the command:
    $ sudo chmod 0600 /boot/System.map-*
CCE-83901-9 | Ensure All SGID Executables Are Authorized | The SGID (set group id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SGID files. This configuration check considers authorized SGID files which were installed via RPM. It is assumed that when an individual has sudo access to install an RPM and all packages are signed with an organizationally-recognized GPG key, the software should be considered an approved package on the system. Any SGID file not deployed through an RPM will be flagged for further review.
CCE-83897-9 | Ensure All SUID Executables Are Authorized | The SUID (set user id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SUID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SUID files. This configuration check considers authorized SUID files which were installed via RPM. It is assumed that when an individual has sudo access to install an RPM and all packages are signed with an organizationally-recognized GPG key, the software should be considered an approved package on the system. Any SUID file not deployed through an RPM will be flagged for further review.
CCE-83902-7 | Ensure No World-Writable Files Exist | It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. Finally, this applies to real files and not virtual files that are a part of pseudo file systems such as `sysfs` or `procfs`.
CCE-83906-8 | Ensure All Files Are Owned by a Group | If any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group. The following command will discover and print any files on local partitions which do not belong to a valid group:
    $ df --local -P | awk '{if (NR!=1) print $6}' | sudo xargs -I '{}' find '{}' -xdev -nogroup
To search all filesystems on a system including network mounted filesystems the following command can be run manually for each partition:
    $ sudo find PARTITION -xdev -nogroup
CCE-83896-1 | Ensure All Files Are Owned by a User | If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. The following command will discover and print any files on local partitions which do not belong to a valid user:
    $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser
To search all filesystems on a system including network mounted filesystems the following command can be run manually for each partition:
    $ sudo find PARTITION -xdev -nouser
CCE-85884-5 | Enable Kernel Parameter to Enforce DAC on FIFOs | To set the runtime status of the `fs.protected_fifos` kernel parameter, run the following command:
    $ sudo sysctl -w fs.protected_fifos=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.protected_fifos = 2
CCE-84110-6 | Enable Kernel Parameter to Enforce DAC on Hardlinks | To set the runtime status of the `fs.protected_hardlinks` kernel parameter, run the following command:
    $ sudo sysctl -w fs.protected_hardlinks=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.protected_hardlinks = 1
CCE-85885-2 | Enable Kernel Parameter to Enforce DAC on Regular files | To set the runtime status of the `fs.protected_regular` kernel parameter, run the following command:
    $ sudo sysctl -w fs.protected_regular=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.protected_regular = 2
CCE-83900-1 | Enable Kernel Parameter to Enforce DAC on Symlinks | To set the runtime status of the `fs.protected_symlinks` kernel parameter, run the following command:
    $ sudo sysctl -w fs.protected_symlinks=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.protected_symlinks = 1
CCE-83928-2 | Verify Group Who Owns Backup group File | To properly set the group owner of `/etc/group-`, run the command:
    $ sudo chgrp root /etc/group-
CCE-83951-4 | Verify Group Who Owns Backup gshadow File | To properly set the group owner of `/etc/gshadow-`, run the command:
    $ sudo chgrp root /etc/gshadow-
CCE-83933-2 | Verify Group Who Owns Backup passwd File | To properly set the group owner of `/etc/passwd-`, run the command:
    $ sudo chgrp root /etc/passwd-
CCE-83938-1 | Verify User Who Owns Backup shadow File | To properly set the group owner of `/etc/shadow-`, run the command:
    $ sudo chgrp root /etc/shadow-
CCE-83945-6 | Verify Group Who Owns group File | To properly set the group owner of `/etc/group`, run the command:
    $ sudo chgrp root /etc/group
CCE-83948-0 | Verify Group Who Owns gshadow File | To properly set the group owner of `/etc/gshadow`, run the command:
    $ sudo chgrp root /etc/gshadow
CCE-83950-6 | Verify Group Who Owns passwd File | To properly set the group owner of `/etc/passwd`, run the command:
    $ sudo chgrp root /etc/passwd
CCE-83930-8 | Verify Group Who Owns shadow File | To properly set the group owner of `/etc/shadow`, run the command:
    $ sudo chgrp root /etc/shadow
CCE-83944-9 | Verify User Who Owns Backup group File | To properly set the owner of `/etc/group-`, run the command:
    $ sudo chown root /etc/group-
CCE-83929-0 | Verify User Who Owns Backup gshadow File | To properly set the owner of `/etc/gshadow-`, run the command:
    $ sudo chown root /etc/gshadow-
CCE-83947-2 | Verify User Who Owns Backup passwd File | To properly set the owner of `/etc/passwd-`, run the command:
    $ sudo chown root /etc/passwd-
CCE-83949-8 | Verify Group Who Owns Backup shadow File | To properly set the owner of `/etc/shadow-`, run the command:
    $ sudo chown root /etc/shadow-
CCE-83925-8 | Verify User Who Owns group File | To properly set the owner of `/etc/group`, run the command:
    $ sudo chown root /etc/group
CCE-83924-1 | Verify User Who Owns gshadow File | To properly set the owner of `/etc/gshadow`, run the command:
    $ sudo chown root /etc/gshadow
CCE-83943-1 | Verify User Who Owns passwd File | To properly set the owner of `/etc/passwd`, run the command:
    $ sudo chown root /etc/passwd
CCE-83926-6 | Verify User Who Owns shadow File | To properly set the owner of `/etc/shadow`, run the command:
    $ sudo chown root /etc/shadow
CCE-83939-9 | Verify Permissions on Backup group File | To properly set the permissions of `/etc/group-`, run the command:
    $ sudo chmod 0644 /etc/group-
CCE-83942-3 | Verify Permissions on Backup gshadow File | To properly set the permissions of `/etc/gshadow-`, run the command:
    $ sudo chmod 0000 /etc/gshadow-
CCE-83940-7 | Verify Permissions on Backup passwd File | To properly set the permissions of `/etc/passwd-`, run the command:
    $ sudo chmod 0644 /etc/passwd-
CCE-83935-7 | Verify Permissions on Backup shadow File | To properly set the permissions of `/etc/shadow-`, run the command:
    $ sudo chmod 0000 /etc/shadow-
CCE-83934-0 | Verify Permissions on group File | To properly set the permissions of `/etc/passwd`, run the command:
    $ sudo chmod 0644 /etc/passwd
CCE-83921-7 | Verify Permissions on gshadow File | To properly set the permissions of `/etc/gshadow`, run the command:
    $ sudo chmod 0000 /etc/gshadow
CCE-83931-6 | Verify Permissions on passwd File | To properly set the permissions of `/etc/passwd`, run the command:
    $ sudo chmod 0644 /etc/passwd
CCE-83941-5 | Verify Permissions on shadow File | To properly set the permissions of `/etc/shadow`, run the command:
    $ sudo chmod 0000 /etc/shadow
CCE-83912-6 | Verify Group Who Owns /var/log Directory | To properly set the group owner of `/var/log`, run the command:
    $ sudo chgrp root /var/log
CCE-83916-7 | Verify Group Who Owns /var/log/messages File | To properly set the group owner of `/var/log/messages`, run the command:
    $ sudo chgrp root /var/log/messages
| Verify Group Who Owns /var/log/syslog File | To properly set the group owner of `/var/log/syslog`, run the command:
    $ sudo chgrp adm /var/log/syslog
CCE-83914-2 | Verify User Who Owns /var/log Directory | To properly set the owner of `/var/log`, run the command:
    $ sudo chown root /var/log
CCE-83915-9 | Verify User Who Owns /var/log/messages File | To properly set the owner of `/var/log/messages`, run the command:
    $ sudo chown root /var/log/messages
| Verify User Who Owns /var/log/syslog File | To properly set the owner of `/var/log/syslog`, run the command:
    $ sudo chown syslog /var/log/syslog
CCE-83917-5 | Verify Permissions on /var/log Directory | To properly set the permissions of `/var/log`, run the command:
    $ sudo chmod 0755 /var/log
CCE-83913-4 | Verify Permissions on /var/log/messages File | To properly set the permissions of `/var/log/messages`, run the command:
    $ sudo chmod 0640 /var/log/messages
| Verify Permissions on /var/log/syslog File | To properly set the permissions of `/var/log/syslog`, run the command:
    $ sudo chmod 0640 /var/log/syslog
CCE-89858-5 | Verify that Shared Library Directories Have Root Group Ownership | System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be group-owned by the `root` user. If the directories, is found to be owned by a user other than root correct its ownership with the following command:
    $ sudo chgrp root DIR
| Verify that System Executable Have Root Ownership |
    /bin
    /sbin
    /usr/bin
    /usr/sbin
    /usr/local/bin
    /usr/local/sbin
All these directories should be owned by the `root` user. If any directory DIR in these directories is found to be owned by a user other than root, correct its ownership with the following command:
    $ sudo chown root DIR
CCE-89022-8 | Verify that Shared Library Directories Have Root Ownership | System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be owned by the `root` user. If the directories, is found to be owned by a user other than root correct its ownership with the following command:
    $ sudo chown root DIR
| Verify that System Executable Directories Have Restrictive Permissions | System executables are stored in the following directories by default:
    /bin
    /sbin
    /usr/bin
    /usr/sbin
    /usr/local/bin
    /usr/local/sbin
These directories should not be group-writable or world-writable. If any directory DIR in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w DIR
CCE-88693-7 | Verify that Shared Library Directories Have Restrictive Permissions | System-wide shared library directories, which contain are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are stored in `/lib/modules`. All sub-directories in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w DIR
CCE-89442-8 | Verify that system commands files are group owned by root | System commands files are stored in the following directories by default:
    /bin
    /sbin
    /usr/bin
    /usr/sbin
    /usr/local/bin
    /usr/local/sbin
All files in these directories should be owned by the `root` group. If the directory, or any file in these directories, is found to be owned by a group other than root correct its ownership with the following command:
    $ sudo chgrp root FILE
CCE-83908-4 | Verify that System Executables Have Root Ownership | System executables are stored in the following directories by default:
    /bin
    /sbin
    /usr/bin
    /usr/libexec
    /usr/local/bin
    /usr/local/sbin
    /usr/sbin
All files in these directories should be owned by the `root` user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command:
    $ sudo chown root FILE
CCE-83907-6 | Verify that Shared Library Files Have Root Ownership | System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be owned by the `root` user. If the directory, or any file in these directories, is found to be owned by a user other than root correct its ownership with the following command:
    $ sudo chown root FILE
CCE-83911-8 | Verify that System Executables Have Restrictive Permissions | System executables are stored in the following directories by default:
    /bin
    /sbin
    /usr/bin
    /usr/libexec
    /usr/local/bin
    /usr/local/sbin
    /usr/sbin
All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w FILE
CCE-83909-2 | Verify that Shared Library Files Have Restrictive Permissions | System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are stored in `/lib/modules`. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w FILE
CCE-87108-7 | Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root. | System-wide library files are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
All system-wide shared library files should be protected from unauthorised access. If any of these files is not group-owned by root, correct its group-owner with the following command:
    $ sudo chgrp root FILE
CCE-83850-8 | Disable the Automounter | The `autofs` daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as `/misc/cd`. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing `/etc/fstab` rather than relying on the automounter. The `autofs` service can be disabled with the following command:
    $ sudo systemctl mask --now autofs.service
CCE-83853-2 | Disable Mounting of cramfs | To configure the system to prevent the `cramfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install cramfs /bin/true
This effectively prevents usage of this uncommon filesystem. The `cramfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `cramfs` image can be used without having to first decompress the image.
| Disable Mounting of freevxfs | To configure the system to prevent the `freevxfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install freevxfs /bin/true
This effectively prevents usage of this uncommon filesystem.
| Disable Mounting of hfs | To configure the system to prevent the `hfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install hfs /bin/true
This effectively prevents usage of this uncommon filesystem.
| Disable Mounting of hfsplus | To configure the system to prevent the `hfsplus` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install hfsplus /bin/true
This effectively prevents usage of this uncommon filesystem.
| Disable Mounting of jffs2 | To configure the system to prevent the `jffs2` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install jffs2 /bin/true
This effectively prevents usage of this uncommon filesystem.
CCE-83855-7 | Disable Mounting of squashfs | To configure the system to prevent the `squashfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install squashfs /bin/true
This effectively prevents usage of this uncommon filesystem. The `squashfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems (similar to `cramfs`). A `squashfs` image can be used without having to first decompress the image.
CCE-83852-4 | Disable Mounting of udf | To configure the system to prevent the `udf` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install udf /bin/true
This effectively prevents usage of this uncommon filesystem. The `udf` filesystem type is the universal disk format used to implement the ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is neccessary to support writing DVDs and newer optical disc formats.
CCE-83851-6 | Disable Modprobe Loading of USB Storage Driver | To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the `usb-storage` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install usb-storage /bin/true
This will prevent the `modprobe` program from loading the `usb-storage` module, but will not prevent an administrator (or another program) from using the `insmod` program to load the module manually.
| Disable Mounting of vFAT filesystems | To configure the system to prevent the `vfat` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install vfat /bin/true
This effectively prevents usage of this uncommon filesystem. The `vFAT` filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types `FAT12`, `FAT16`, and `FAT32` all of which are supported by the `vfat` kernel module.
| Add noauto Option to /boot | The `noauto` mount option is used to prevent automatic mounting of th `/boot` partition. Add the `noauto` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.
CCE-83884-7 | Add nodev Option to /boot | The `nodev` mount option can be used to prevent device files from being created in `/boot`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.
CCE-83892-0 | Add noexec Option to /boot | The `noexec` mount option can be used to prevent binaries from being executed out of `/boot`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.
CCE-83877-1 | Add nosuid Option to /boot | The `nosuid` mount option can be used to prevent execution of setuid programs in `/boot`. The SUID and SGID permissions should not be required on the boot partition. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`.
CCE-83881-3 | Add nodev Option to /dev/shm | The `nodev` mount option can be used to prevent creation of device files in `/dev/shm`. Legitimate character and block devices should not exist within temporary directories like `/dev/shm`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.
CCE-83857-3 | Add noexec Option to /dev/shm | The `noexec` mount option can be used to prevent binaries from being executed out of `/dev/shm`. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as `/dev/shm`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.
CCE-83891-2 | Add nosuid Option to /dev/shm | The `nosuid` mount option can be used to prevent execution of setuid programs in `/dev/shm`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.
CCE-83871-4 | Add nodev Option to /home | The `nodev` mount option can be used to prevent device files from being created in `/home`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.
CCE-83875-5 | Add noexec Option to /home | The `noexec` mount option can be used to prevent binaries from being executed out of `/home`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.
CCE-83894-6 | Add nosuid Option to /home | The `nosuid` mount option can be used to prevent execution of setuid programs in `/home`. The SUID and SGID permissions should not be required in these user data directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.
CCE-83873-0 | Add nodev Option to Non-Root Local Partitions | The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any non-root local partitions.
CCE-83856-5 | Add nodev Option to Removable Media Partitions | The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.
CCE-83883-9 | Add noexec Option to Removable Media Partitions | The `noexec` mount option prevents the direct execution of binaries on the mounted filesystem. Preventing the direct execution of binaries from removable media (such as a USB key) provides a defense against malicious software that may be present on such untrusted media. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.
CCE-83874-8 | Add nosuid Option to Removable Media Partitions | The `nosuid` mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) permissions from taking effect. These permissions allow users to execute binaries with the same permissions as the owner and group of the file respectively. Users should not be allowed to introduce SUID and SGID files into the system via partitions mounted from removeable media. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.
CCE-83880-5 | Add nosuid Option to /opt | The `nosuid` mount option can be used to prevent execution of setuid programs in `/opt`. The SUID and SGID permissions should not be required in this directory. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/opt`.
CCE-85883-7 | Add hidepid Option to /proc | The `hidepid` mount option is applicable to `/proc` and is used to control who can access the information in `/proc/[pid]` directories. The option can have one of the following values:
    0: Everybody may access all /proc/[pid] directories.
    1: Users may not access files and subdirectories inside any /proc/[pid] directories
       but their own. The /proc/[pid] directories themselves remain visible.
    2: Same as for mode 1, but in addition the /proc/[pid] directories belonging to other
       users become invisible.
For example, if you choose the value 2: Add the `hidepid=2` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/proc`.
CCE-83862-3 | Add nosuid Option to /srv | The `nosuid` mount option can be used to prevent execution of setuid programs in `/srv`. The SUID and SGID permissions should not be required in this directory. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/srv`.
CCE-83869-8 | Add nodev Option to /tmp | The `nodev` mount option can be used to prevent device files from being created in `/tmp`. Legitimate character and block devices should not exist within temporary directories like `/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
CCE-83885-4 | Add noexec Option to /tmp | The `noexec` mount option can be used to prevent binaries from being executed out of `/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
CCE-83872-2 | Add nosuid Option to /tmp | The `nosuid` mount option can be used to prevent execution of setuid programs in `/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
CCE-83882-1 | Add nodev Option to /var/log/audit | The `nodev` mount option can be used to prevent device files from being created in `/var/log/audit`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.
CCE-83878-9 | Add noexec Option to /var/log/audit | The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log/audit`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.
CCE-83893-8 | Add nosuid Option to /var/log/audit | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log/audit`. The SUID and SGID permissions should not be required in directories containing audit log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`.
CCE-83886-2 | Add nodev Option to /var/log | The `nodev` mount option can be used to prevent device files from being created in `/var/log`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.
CCE-83887-0 | Add noexec Option to /var/log | The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.
CCE-83870-6 | Add nosuid Option to /var/log | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log`. The SUID and SGID permissions should not be required in directories containing log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`.
CCE-83868-0 | Add nodev Option to /var | The `nodev` mount option can be used to prevent device files from being created in `/var`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`.
CCE-83865-6 | Add noexec Option to /var | The `noexec` mount option can be used to prevent binaries from being executed out of `/var`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`.
CCE-83867-2 | Add nosuid Option to /var | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var`. The SUID and SGID permissions should not be required for this directory. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`.
| Bind Mount /var/tmp To /tmp | The `/var/tmp` directory is a world-writable directory. Bind-mount it to `/tmp` in order to consolidate temporary storage into one location protected by the same techniques as `/tmp`. To do so, edit `/etc/fstab` and add the following line:
    /tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0
See the `mount(8)` man page for further explanation of bind mounting.
CCE-83864-9 | Add nodev Option to /var/tmp | The `nodev` mount option can be used to prevent device files from being created in `/var/tmp`. Legitimate character and block devices should not exist within temporary directories like `/var/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
CCE-83866-4 | Add noexec Option to /var/tmp | The `noexec` mount option can be used to prevent binaries from being executed out of `/var/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
CCE-83863-1 | Add nosuid Option to /var/tmp | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
CCE-83961-3 | Disable storing core dumps | To set the runtime status of the `kernel.core_pattern` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.core_pattern=|/bin/false
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.core_pattern = |/bin/false
CCE-83952-2 | Restrict Access to Kernel Message Buffer | To set the runtime status of the `kernel.dmesg_restrict` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.dmesg_restrict=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.dmesg_restrict = 1
CCE-83954-8 | Disable Kernel Image Loading | To set the runtime status of the `kernel.kexec_load_disabled` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.kexec_load_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.kexec_load_disabled = 1
CCE-83967-0 | Disable loading and unloading of kernel modules | To set the runtime status of the `kernel.modules_disabled` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.modules_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.modules_disabled = 1
CCE-88666-3 | Kernel panic on oops | To set the runtime status of the `kernel.panic_on_oops` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.panic_on_oops=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.panic_on_oops = 1
CCE-83969-6 | Limit CPU consumption of the Perf system | To set the runtime status of the `kernel.perf_cpu_time_max_percent` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.perf_cpu_time_max_percent=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.perf_cpu_time_max_percent = 1
CCE-83962-1 | Limit sampling frequency of the Perf system | To set the runtime status of the `kernel.perf_event_max_sample_rate` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.perf_event_max_sample_rate=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.perf_event_max_sample_rate = 1
CCE-83959-7 | Disallow kernel profiling by unprivileged users | To set the runtime status of the `kernel.perf_event_paranoid` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.perf_event_paranoid=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.perf_event_paranoid = 2
CCE-83960-5 | Configure maximum number of process identifiers | To set the runtime status of the `kernel.pid_max` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.pid_max=65536
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.pid_max = 65536
CCE-83968-8 | Disallow magic SysRq key | To set the runtime status of the `kernel.sysrq` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.sysrq=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.sysrq = 0
CCE-83957-1 | Disable Access to Network bpf() Syscall From Unprivileged Processes | To set the runtime status of the `kernel.unprivileged_bpf_disabled` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.unprivileged_bpf_disabled = 1
CCE-83965-4 | Restrict usage of ptrace to descendant processes | To set the runtime status of the `kernel.yama.ptrace_scope` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.yama.ptrace_scope=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.yama.ptrace_scope = 1
CCE-83966-2 | Harden the operation of the BPF just-in-time compiler | To set the runtime status of the `net.core.bpf_jit_harden` kernel parameter, run the following command:
    $ sudo sysctl -w net.core.bpf_jit_harden=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.core.bpf_jit_harden = 2
CCE-83956-3 | Disable the use of user namespaces | To set the runtime status of the `user.max_user_namespaces` kernel parameter, run the following command:
    $ sudo sysctl -w user.max_user_namespaces=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    user.max_user_namespaces = 0
When containers are deployed on the machine, the value should be set to large non-zero value.
CCE-83958-9 | Prevent applications from mapping low portion of virtual memory | To set the runtime status of the `vm.mmap_min_addr` kernel parameter, run the following command:
    $ sudo sysctl -w vm.mmap_min_addr=65536
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    vm.mmap_min_addr = 65536
CCE-83974-6 | Disable acquiring, saving, and processing core dumps | The `systemd-coredump.socket` unit is a socket activation of the `systemd-coredump@.service` which processes core dumps. By masking the unit, core dump processing is disabled.
CCE-83984-5 | Disable core dump backtraces | The `ProcessSizeMax` option in `[Coredump]` section of `/etc/systemd/coredump.conf` specifies the maximum size in bytes of a core which will be processed. Core dumps exceeding this size may be stored, but the backtrace will not be generated.
CCE-83979-5 | Disable storing core dump | The `Storage` option in `[Coredump]` section of `/etc/systemd/coredump.conf` can be set to `none` to disable storing core dumps permanently.
CCE-83980-3 | Disable Core Dumps for All Users | To disable core dumps for all users, add the following line to `/etc/security/limits.conf`, or to a file within the `/etc/security/limits.d/` directory:
    *     hard   core    0
CCE-83981-1 | Disable Core Dumps for SUID programs | To set the runtime status of the `fs.suid_dumpable` kernel parameter, run the following command:
    $ sudo sysctl -w fs.suid_dumpable=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.suid_dumpable = 0
CCE-83970-4 | Enable ExecShield via sysctl | By default on Red Hat Enterprise Linux 7 64-bit systems, ExecShield is enabled and can only be disabled if the hardware does not support ExecShield or is disabled in `/etc/default/grub`. For Red Hat Enterprise Linux 7 32-bit systems, `sysctl` can be used to enable ExecShield.
CCE-83972-0 | Restrict Exposed Kernel Pointer Addresses Access | To set the runtime status of the `kernel.kptr_restrict` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.kptr_restrict=
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.kptr_restrict =
CCE-83971-2 | Enable Randomized Layout of Virtual Address Space | To set the runtime status of the `kernel.randomize_va_space` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.randomize_va_space=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.randomize_va_space = 2
CCE-88577-2 | Enable NX or XD Support in the BIOS | Reboot the system and enter the BIOS or Setup configuration menu. Navigate the BIOS configuration menu and make sure that the option is enabled. The setting may be located under a Security section. Look for Execute Disable (XD) on Intel-based systems and No Execute (NX) on AMD-based systems.
CCE-83985-2 | Enable page allocator poisoning | To enable poisoning of free pages, add the argument `page_poison=1` to the default GRUB 2 command line for the Linux operating system. To ensure that `page_poison=1` is added as a kernel command line argument to newly installed kernels, ad `page_poison=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... page_poison=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="page_poison=1"
CCE-83986-0 | Enable SLUB/SLAB allocator poisoning | To enable poisoning of SLUB/SLAB objects, add the argument `slub_debug=P` to the default GRUB 2 command line for the Linux operating system. To ensure that `slub_debug=P` is added as a kernel command line argument to newly installed kernels, ad `slub_debug=P` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... slub_debug=P ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="slub_debug=P"
CCE-84069-4 | Install libselinux Package | The `libselinux` package can be installed with the following command:
    $ sudo dnf install libselinux
CCE-84070-2 | Install policycoreutils-python-utils package | The `policycoreutils-python-utils` package can be installed with the following command:
    $ sudo dnf install policycoreutils-python-utils
CCE-84071-0 | Install policycoreutils Package | The `policycoreutils` package can be installed with the following command:
    $ sudo dnf install policycoreutils
CCE-84072-8 | Uninstall mcstrans Package | The `mcstransd` daemon provides category label information to client processes requesting information. The label translations are defined in `/etc/selinux/targeted/setrans.conf`. The `mcstrans` package can be removed with the following command:
    $ sudo dnf erase mcstrans
CCE-84251-8 | Uninstall setroubleshoot-plugins Package | The SETroubleshoot plugins are used to analyze SELinux AVC data. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The `setroubleshoot-plugins` package can be removed with the following command:
    $ sudo dnf erase setroubleshoot-plugins
CCE-84252-6 | Uninstall setroubleshoot-server Package | The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The `setroubleshoot-server` package can be removed with the following command:
    $ sudo dnf erase setroubleshoot-server
CCE-84073-6 | Uninstall setroubleshoot Package | The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The `setroubleshoot` package can be removed with the following command:
    $ sudo dnf erase setroubleshoot
| Ensure SELinux Not Disabled in the kernel arguments | SELinux can be disabled at boot time by disabling it via a kernel argument. Remove any instances of `selinux=0` from the kernel arguments in that file to prevent SELinux from being disabled at boot.
CCE-84078-5 | Ensure SELinux Not Disabled in /etc/default/grub | SELinux can be disabled at boot time by an argument in `/etc/default/grub`. Remove any instances of `selinux=0` from the kernel arguments in that file to prevent SELinux from being disabled at boot.
| Ensure No Device Files are Unlabeled by SELinux | Device files, which are used for communication with important system resources, should be labeled with proper SELinux types. If any device files carry the SELinux type `device_t` or `unlabeled_t`, report the bug so that policy can be corrected. Supply information about what the device is and what programs use it. To check for incorrectly labeled device files, run following commands:
    $ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
    $ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"
It should produce no output in a well-configured system.
CCE-84075-1 | Ensure No Daemons are Unconfined by SELinux | Daemons for which the SELinux policy does not contain rules will inherit the context of the parent process. Because daemons are launched during startup and descend from the `init` process, they inherit the `unconfined_service_t` context. To check for unconfined daemons, run the following command:
    $ sudo ps -eZ | grep "unconfined_service_t"
It should produce no output in a well-configured system.
CCE-84074-4 | Configure SELinux Policy | The SELinux `targeted` policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in `/etc/selinux/config`:
    SELINUXTYPE=
Other policies, such as `mls`, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.
CCE-84079-3 | Ensure SELinux State is Enforcing | The SELinux state should be set to `` at system boot time. In the file `/etc/selinux/config`, add or correct the following line to configure the system to boot into enforcing mode:
    SELINUX=
| Map System Users To The Appropriate SELinux Role | Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. All administrators must be mapped to the `sysadm_u` or `staff_u` users with the appropriate domains (`sysadm_t` and `staff_t`).
    $ sudo semanage login -m -s sysadm_u USER
or
    $ sudo semanage login -m -s staff_u USER
All authorized non-administrative users must be mapped to the `user_u` role or the appropriate domain (user_t).
    $ sudo semanage login -m -s user_u USER
| Enable the antivirus_can_scan_system SELinux Boolean | By default, the SELinux boolean `antivirus_can_scan_system` is disabled. This setting should be enabled as it allows antivirus programs to read non-security files on a system. To enable the `antivirus_can_scan_system` SELinux boolean, run the following command:
    $ sudo setsebool -P antivirus_can_scan_system on
| Disable the antivirus_use_jit SELinux Boolean | By default, the SELinux boolean `antivirus_use_jit` is disabled. If this setting is enabled, it should be disabled. To disable the `antivirus_use_jit` SELinux boolean, run the following command:
    $ sudo setsebool -P antivirus_use_jit off
CCE-84090-0 | Enable the auditadm_exec_content SELinux Boolean | By default, the SELinux boolean `auditadm_exec_content` is enabled. If this setting is disabled, it should be enabled. To enable the `auditadm_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P auditadm_exec_content on
| Disable the authlogin_nsswitch_use_ldap SELinux Boolean | By default, the SELinux boolean `authlogin_nsswitch_use_ldap` is disabled. If this setting is enabled, it should be disabled. To disable the `authlogin_nsswitch_use_ldap` SELinux boolean, run the following command:
    $ sudo setsebool -P authlogin_nsswitch_use_ldap off
| Disable the authlogin_radius SELinux Boolean | By default, the SELinux boolean `authlogin_radius` is disabled. If this setting is enabled, it should be disabled. To disable the `authlogin_radius` SELinux boolean, run the following command:
    $ sudo setsebool -P authlogin_radius off
| Disable the authlogin_yubikey SELinux Boolean | By default, the SELinux boolean `authlogin_yubikey` is disabled. If this setting is enabled, it should be disabled. To disable the `authlogin_yubikey` SELinux boolean, run the following command:
    $ sudo setsebool -P authlogin_yubikey off
| Disable the awstats_purge_apache_log_files SELinux Boolean | By default, the SELinux boolean `awstats_purge_apache_log_files` is disabled. If this setting is enabled, it should be disabled. To disable the `awstats_purge_apache_log_files` SELinux boolean, run the following command:
    $ sudo setsebool -P awstats_purge_apache_log_files off
| Disable the boinc_execmem SELinux Boolean | By default, the SELinux boolean `boinc_execmem` is enabled. This setting should be disabled. To disable the `boinc_execmem` SELinux boolean, run the following command:
    $ sudo setsebool -P boinc_execmem off
| Disable the cdrecord_read_content SELinux Boolean | By default, the SELinux boolean `cdrecord_read_content` is disabled. If this setting is enabled, it should be disabled. To disable the `cdrecord_read_content` SELinux boolean, run the following command:
    $ sudo setsebool -P cdrecord_read_content off
| Disable the cluster_can_network_connect SELinux Boolean | By default, the SELinux boolean `cluster_can_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `cluster_can_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P cluster_can_network_connect off
| Disable the cluster_manage_all_files SELinux Boolean | By default, the SELinux boolean `cluster_manage_all_files` is disabled. If this setting is enabled, it should be disabled. To disable the `cluster_manage_all_files` SELinux boolean, run the following command:
    $ sudo setsebool -P cluster_manage_all_files off
| Disable the cluster_use_execmem SELinux Boolean | By default, the SELinux boolean `cluster_use_execmem` is disabled. If this setting is enabled, it should be disabled. To disable the `cluster_use_execmem` SELinux boolean, run the following command:
    $ sudo setsebool -P cluster_use_execmem off
| Disable the cobbler_anon_write SELinux Boolean | By default, the SELinux boolean `cobbler_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `cobbler_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P cobbler_anon_write off
| Disable the cobbler_can_network_connect SELinux Boolean | By default, the SELinux boolean `cobbler_can_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `cobbler_can_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P cobbler_can_network_connect off
| Disable the cobbler_use_cifs SELinux Boolean | By default, the SELinux boolean `cobbler_use_cifs` is disabled. If this setting is enabled, it should be disabled. To disable the `cobbler_use_cifs` SELinux boolean, run the following command:
    $ sudo setsebool -P cobbler_use_cifs off
| Disable the cobbler_use_nfs SELinux Boolean | By default, the SELinux boolean `cobbler_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `cobbler_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P cobbler_use_nfs off
| Disable the collectd_tcp_network_connect SELinux Boolean | By default, the SELinux boolean `collectd_tcp_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `collectd_tcp_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P collectd_tcp_network_connect off
| Disable the condor_tcp_network_connect SELinux Boolean | By default, the SELinux boolean `condor_tcp_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `condor_tcp_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P condor_tcp_network_connect off
| Disable the conman_can_network SELinux Boolean | By default, the SELinux boolean `conman_can_network` is disabled. If this setting is enabled, it should be disabled. To disable the `conman_can_network` SELinux boolean, run the following command:
    $ sudo setsebool -P conman_can_network off
| Disable the container_connect_any SELinux Boolean | By default, the SELinux boolean `container_connect_any` is disabled. If this setting is enabled, it should be disabled. To disable the `container_connect_any` SELinux boolean, run the following command:
    $ sudo setsebool -P container_connect_any off
| Disable the cron_can_relabel SELinux Boolean | By default, the SELinux boolean `cron_can_relabel` is disabled. If this setting is enabled, it should be disabled. To disable the `cron_can_relabel` SELinux boolean, run the following command:
    $ sudo setsebool -P cron_can_relabel off
| Disable the cron_system_cronjob_use_shares SELinux Boolean | By default, the SELinux boolean `cron_system_cronjob_use_shares` is disabled. If this setting is enabled, it should be disabled. To disable the `cron_system_cronjob_use_shares` SELinux boolean, run the following command:
    $ sudo setsebool -P cron_system_cronjob_use_shares off
| Enable the cron_userdomain_transition SELinux Boolean | By default, the SELinux boolean `cron_userdomain_transition` is enabled. This setting should be enabled as end user cron jobs run in their default associated user domain(s) instead of the general cronjob domain. To enable the `cron_userdomain_transition` SELinux boolean, run the following command:
    $ sudo setsebool -P cron_userdomain_transition on
| Disable the cups_execmem SELinux Boolean | By default, the SELinux boolean `cups_execmem` is disabled. If this setting is enabled, it should be disabled. To disable the `cups_execmem` SELinux boolean, run the following command:
    $ sudo setsebool -P cups_execmem off
| Disable the cvs_read_shadow SELinux Boolean | By default, the SELinux boolean `cvs_read_shadow` is disabled. If this setting is enabled, it should be disabled. To disable the `cvs_read_shadow` SELinux boolean, run the following command:
    $ sudo setsebool -P cvs_read_shadow off
| Disable the daemons_dump_core SELinux Boolean | By default, the SELinux boolean `daemons_dump_core` is disabled. If this setting is enabled, it should be disabled. To disable the `daemons_dump_core` SELinux boolean, run the following command:
    $ sudo setsebool -P daemons_dump_core off
| Disable the daemons_enable_cluster_mode SELinux Boolean | By default, the SELinux boolean `daemons_enable_cluster_mode` is disabled. If this setting is enabled, it should be disabled. To disable the `daemons_enable_cluster_mode` SELinux boolean, run the following command:
    $ sudo setsebool -P daemons_enable_cluster_mode off
| Disable the daemons_use_tcp_wrapper SELinux Boolean | By default, the SELinux boolean `daemons_use_tcp_wrapper` is disabled. If this setting is enabled, it should be disabled. To disable the `daemons_use_tcp_wrapper` SELinux boolean, run the following command:
    $ sudo setsebool -P daemons_use_tcp_wrapper off
| Disable the daemons_use_tty SELinux Boolean | By default, the SELinux boolean `daemons_use_tty` is disabled. If this setting is enabled, it should be disabled. To disable the `daemons_use_tty` SELinux boolean, run the following command:
    $ sudo setsebool -P daemons_use_tty off
| Enable the dbadm_exec_content SELinux Boolean | By default, the SELinux boolean `dbadm_exec_content` is enabled. If this setting is disabled, it should be enabled. To enable the `dbadm_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P dbadm_exec_content on
| Disable the dbadm_manage_user_files SELinux Boolean | By default, the SELinux boolean `dbadm_manage_user_files` is disabled. If this setting is enabled, it should be disabled. To disable the `dbadm_manage_user_files` SELinux boolean, run the following command:
    $ sudo setsebool -P dbadm_manage_user_files off
| Disable the dbadm_read_user_files SELinux Boolean | By default, the SELinux boolean `dbadm_read_user_files` is disabled. If this setting is enabled, it should be disabled. To disable the `dbadm_read_user_files` SELinux boolean, run the following command:
    $ sudo setsebool -P dbadm_read_user_files off
CCE-84082-7 | Enable the deny_execmem SELinux Boolean | By default, the SELinux boolean `deny_execmem` is disabled. If this setting is disabled, it should be enabled. To disable the `deny_execmem` SELinux boolean, run the following command:
    $ sudo setsebool -P deny_execmem off
| Disable the deny_ptrace SELinux Boolean | By default, the SELinux boolean `deny_ptrace` is disabled. If this setting is enabled, it should be disabled. To disable the `deny_ptrace` SELinux boolean, run the following command:
    $ sudo setsebool -P deny_ptrace off
| Disable the dhcpc_exec_iptables SELinux Boolean | By default, the SELinux boolean `dhcpc_exec_iptables` is disabled. If this setting is enabled, it should be disabled. To disable the `dhcpc_exec_iptables` SELinux boolean, run the following command:
    $ sudo setsebool -P dhcpc_exec_iptables off
| Disable the dhcpd_use_ldap SELinux Boolean | By default, the SELinux boolean `dhcpd_use_ldap` is disabled. If this setting is enabled, it should be disabled. To disable the `dhcpd_use_ldap` SELinux boolean, run the following command:
    $ sudo setsebool -P dhcpd_use_ldap off
| Enable the domain_fd_use SELinux Boolean | By default, the SELinux boolean `domain_fd_use` is enabled. If this setting is disabled, it should be enabled. To enable the `domain_fd_use` SELinux boolean, run the following command:
    $ sudo setsebool -P domain_fd_use on
| Disable the domain_kernel_load_modules SELinux Boolean | By default, the SELinux boolean `domain_kernel_load_modules` is disabled. If this setting is enabled, it should be disabled. To disable the `domain_kernel_load_modules` SELinux boolean, run the following command:
    $ sudo setsebool -P domain_kernel_load_modules off
| Disable the entropyd_use_audio SELinux Boolean | By default, the SELinux boolean `entropyd_use_audio` is enabled. This setting should be disabled as it uses audit input to generate entropy. To disable the `entropyd_use_audio` SELinux boolean, run the following command:
    $ sudo setsebool -P entropyd_use_audio off
| Disable the exim_can_connect_db SELinux Boolean | By default, the SELinux boolean `exim_can_connect_db` is disabled. If this setting is enabled, it should be disabled. To disable the `exim_can_connect_db` SELinux boolean, run the following command:
    $ sudo setsebool -P exim_can_connect_db off
| Disable the exim_manage_user_files SELinux Boolean | By default, the SELinux boolean `exim_manage_user_files` is disabled. If this setting is enabled, it should be disabled. To disable the `exim_manage_user_files` SELinux boolean, run the following command:
    $ sudo setsebool -P exim_manage_user_files off
| Disable the exim_read_user_files SELinux Boolean | By default, the SELinux boolean `exim_read_user_files` is disabled. If this setting is enabled, it should be disabled. To disable the `exim_read_user_files` SELinux boolean, run the following command:
    $ sudo setsebool -P exim_read_user_files off
| Disable the fcron_crond SELinux Boolean | By default, the SELinux boolean `fcron_crond` is disabled. If this setting is enabled, it should be disabled. To disable the `fcron_crond` SELinux boolean, run the following command:
    $ sudo setsebool -P fcron_crond off
| Disable the fenced_can_network_connect SELinux Boolean | By default, the SELinux boolean `fenced_can_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `fenced_can_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P fenced_can_network_connect off
| Disable the fenced_can_ssh SELinux Boolean | By default, the SELinux boolean `fenced_can_ssh` is disabled. If this setting is enabled, it should be disabled. To disable the `fenced_can_ssh` SELinux boolean, run the following command:
    $ sudo setsebool -P fenced_can_ssh off
| Enable the fips_mode SELinux Boolean | By default, the SELinux boolean `fips_mode` is enabled. This allows all SELinux domains to execute in `fips_mode`. If this setting is disabled, it should be enabled. To enable the `fips_mode` SELinux boolean, run the following command:
    $ sudo setsebool -P fips_mode on
| Disable the ftpd_anon_write SELinux Boolean | By default, the SELinux boolean `ftpd_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `ftpd_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P ftpd_anon_write off
| Disable the ftpd_connect_all_unreserved SELinux Boolean | By default, the SELinux boolean `ftpd_connect_all_unreserved` is disabled. If this setting is enabled, it should be disabled. To disable the `ftpd_connect_all_unreserved` SELinux boolean, run the following command:
    $ sudo setsebool -P ftpd_connect_all_unreserved off
| Disable the ftpd_connect_db SELinux Boolean | By default, the SELinux boolean `ftpd_connect_db` is disabled. If this setting is enabled, it should be disabled. To disable the `ftpd_connect_db` SELinux boolean, run the following command:
    $ sudo setsebool -P ftpd_connect_db off
| Disable the ftpd_full_access SELinux Boolean | By default, the SELinux boolean `ftpd_full_access` is disabled. If this setting is enabled, it should be disabled. To disable the `ftpd_full_access` SELinux boolean, run the following command:
    $ sudo setsebool -P ftpd_full_access off
| Disable the ftpd_use_cifs SELinux Boolean | By default, the SELinux boolean `ftpd_use_cifs` is disabled. If this setting is enabled, it should be disabled. To disable the `ftpd_use_cifs` SELinux boolean, run the following command:
    $ sudo setsebool -P ftpd_use_cifs off
| Disable the ftpd_use_fusefs SELinux Boolean | By default, the SELinux boolean `ftpd_use_fusefs` is disabled. If this setting is enabled, it should be disabled. To disable the `ftpd_use_fusefs` SELinux boolean, run the following command:
    $ sudo setsebool -P ftpd_use_fusefs off
| Disable the ftpd_use_nfs SELinux Boolean | By default, the SELinux boolean `ftpd_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `ftpd_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P ftpd_use_nfs off
| Disable the ftpd_use_passive_mode SELinux Boolean | By default, the SELinux boolean `ftpd_use_passive_mode` is disabled. If this setting is enabled, it should be disabled. To disable the `ftpd_use_passive_mode` SELinux boolean, run the following command:
    $ sudo setsebool -P ftpd_use_passive_mode off
| Disable the git_cgi_enable_homedirs SELinux Boolean | By default, the SELinux boolean `git_cgi_enable_homedirs` is disabled. If this setting is enabled, it should be disabled. To disable the `git_cgi_enable_homedirs` SELinux boolean, run the following command:
    $ sudo setsebool -P git_cgi_enable_homedirs off
| Disable the git_cgi_use_cifs SELinux Boolean | By default, the SELinux boolean `git_cgi_use_cifs` is disabled. If this setting is enabled, it should be disabled. To disable the `git_cgi_use_cifs` SELinux boolean, run the following command:
    $ sudo setsebool -P git_cgi_use_cifs off
| Disable the git_cgi_use_nfs SELinux Boolean | By default, the SELinux boolean `git_cgi_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `git_cgi_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P git_cgi_use_nfs off
| Disable the git_session_bind_all_unreserved_ports SELinux Boolean | By default, the SELinux boolean `git_session_bind_all_unreserved_ports` is disabled. If this setting is enabled, it should be disabled. To disable the `git_session_bind_all_unreserved_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P git_session_bind_all_unreserved_ports off
| Disable the git_session_users SELinux Boolean | By default, the SELinux boolean `git_session_users` is disabled. If this setting is enabled, it should be disabled. To disable the `git_session_users` SELinux boolean, run the following command:
    $ sudo setsebool -P git_session_users off
| Disable the git_system_enable_homedirs SELinux Boolean | By default, the SELinux boolean `git_system_enable_homedirs` is disabled. If this setting is enabled, it should be disabled. To disable the `git_system_enable_homedirs` SELinux boolean, run the following command:
    $ sudo setsebool -P git_system_enable_homedirs off
| Disable the git_system_use_cifs SELinux Boolean | By default, the SELinux boolean `git_system_use_cifs` is disabled. If this setting is enabled, it should be disabled. To disable the `git_system_use_cifs` SELinux boolean, run the following command:
    $ sudo setsebool -P git_system_use_cifs off
| Disable the git_system_use_nfs SELinux Boolean | By default, the SELinux boolean `git_system_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `git_system_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P git_system_use_nfs off
| Disable the gitosis_can_sendmail SELinux Boolean | By default, the SELinux boolean `gitosis_can_sendmail` is disabled. If this setting is enabled, it should be disabled. To disable the `gitosis_can_sendmail` SELinux boolean, run the following command:
    $ sudo setsebool -P gitosis_can_sendmail off
| Disable the glance_api_can_network SELinux Boolean | By default, the SELinux boolean `glance_api_can_network` is disabled. If this setting is enabled, it should be disabled. To disable the `glance_api_can_network` SELinux boolean, run the following command:
    $ sudo setsebool -P glance_api_can_network off
| Disable the glance_use_execmem SELinux Boolean | By default, the SELinux boolean `glance_use_execmem` is disabled. If this setting is enabled, it should be disabled. To disable the `glance_use_execmem` SELinux boolean, run the following command:
    $ sudo setsebool -P glance_use_execmem off
| Disable the glance_use_fusefs SELinux Boolean | By default, the SELinux boolean `glance_use_fusefs` is disabled. If this setting is enabled, it should be disabled. To disable the `glance_use_fusefs` SELinux boolean, run the following command:
    $ sudo setsebool -P glance_use_fusefs off
| Disable the global_ssp SELinux Boolean | By default, the SELinux boolean `global_ssp` is disabled. If this setting is enabled, it should be disabled. To disable the `global_ssp` SELinux boolean, run the following command:
    $ sudo setsebool -P global_ssp off
| Disable the gluster_anon_write SELinux Boolean | By default, the SELinux boolean `gluster_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `gluster_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P gluster_anon_write off
| Disable the gluster_export_all_ro SELinux Boolean | By default, the SELinux boolean `gluster_export_all_ro` is disabled. If this setting is enabled, it should be disabled. To disable the `gluster_export_all_ro` SELinux boolean, run the following command:
    $ sudo setsebool -P gluster_export_all_ro off
| Configure the gluster_export_all_rw SELinux Boolean | By default, the SELinux boolean `gluster_export_all_rw` is enabled. If `GlusterFS` is in use, this setting should be enabled. Otherwise, disable it. To disable the `gluster_export_all_rw` SELinux boolean, run the following command:
    $ sudo setsebool -P gluster_export_all_rw off
| Disable the gpg_web_anon_write SELinux Boolean | By default, the SELinux boolean `gpg_web_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `gpg_web_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P gpg_web_anon_write off
| Enable the gssd_read_tmp SELinux Boolean | By default, the SELinux boolean `gssd_read_tmp` is enabled. This setting allows `gssd` processes to access Kerberos to read TGTs in the temp directory. If this setting is disabled, it should be enabled. To enable the `gssd_read_tmp` SELinux boolean, run the following command:
    $ sudo setsebool -P gssd_read_tmp on
| Disable the guest_exec_content SELinux Boolean | By default, the SELinux boolean `guest_exec_content` is enabled. This setting should be disabled as no guest accounts should be used. To disable the `guest_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P guest_exec_content off
| Disable the haproxy_connect_any SELinux Boolean | By default, the SELinux boolean `haproxy_connect_any` is disabled. If this setting is enabled, it should be disabled. To disable the `haproxy_connect_any` SELinux boolean, run the following command:
    $ sudo setsebool -P haproxy_connect_any off
| Disable the httpd_anon_write SELinux Boolean | By default, the SELinux boolean `httpd_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_anon_write off
| Configure the httpd_builtin_scripting SELinux Boolean | By default, the SELinux boolean `httpd_builtin_scripting` is enabled. This setting should be disabled if `httpd` is not running `php` or some similary scripting language. To disable the `httpd_builtin_scripting` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_builtin_scripting off
| Disable the httpd_can_check_spam SELinux Boolean | By default, the SELinux boolean `httpd_can_check_spam` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_check_spam` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_check_spam off
| Disable the httpd_can_connect_ftp SELinux Boolean | By default, the SELinux boolean `httpd_can_connect_ftp` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_connect_ftp` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_connect_ftp off
| Disable the httpd_can_connect_ldap SELinux Boolean | By default, the SELinux boolean `httpd_can_connect_ldap` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_connect_ldap` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_connect_ldap off
| Disable the httpd_can_connect_mythtv SELinux Boolean | By default, the SELinux boolean `httpd_can_connect_mythtv` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_connect_mythtv` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_connect_mythtv off
| Disable the httpd_can_connect_zabbix SELinux Boolean | By default, the SELinux boolean `httpd_can_connect_zabbix` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_connect_zabbix` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_connect_zabbix off
| Disable the httpd_can_network_connect SELinux Boolean | By default, the SELinux boolean `httpd_can_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_network_connect off
| Disable the httpd_can_network_connect_cobbler SELinux Boolean | By default, the SELinux boolean `httpd_can_network_connect_cobbler` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_network_connect_cobbler` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_network_connect_cobbler off
| Disable the httpd_can_network_connect_db SELinux Boolean | By default, the SELinux boolean `httpd_can_network_connect_db` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_network_connect_db` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_network_connect_db off
| Disable the httpd_can_network_memcache SELinux Boolean | By default, the SELinux boolean `httpd_can_network_memcache` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_network_memcache` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_network_memcache off
| Disable the httpd_can_network_relay SELinux Boolean | By default, the SELinux boolean `httpd_can_network_relay` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_network_relay` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_network_relay off
| Disable the httpd_can_sendmail SELinux Boolean | By default, the SELinux boolean `httpd_can_sendmail` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_can_sendmail` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_can_sendmail off
| Disable the httpd_dbus_avahi SELinux Boolean | By default, the SELinux boolean `httpd_dbus_avahi` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_dbus_avahi` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_dbus_avahi off
| Disable the httpd_dbus_sssd SELinux Boolean | By default, the SELinux boolean `httpd_dbus_sssd` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_dbus_sssd` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_dbus_sssd off
| Disable the httpd_dontaudit_search_dirs SELinux Boolean | By default, the SELinux boolean `httpd_dontaudit_search_dirs` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_dontaudit_search_dirs` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_dontaudit_search_dirs off
| Configure the httpd_enable_cgi SELinux Boolean | By default, the SELinux boolean `httpd_enable_cgi` is enabled. This setting should be disabled unless `httpd` is used with `CGI` scripting. To disable the `httpd_enable_cgi` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_enable_cgi off
| Disable the httpd_enable_ftp_server SELinux Boolean | By default, the SELinux boolean `httpd_enable_ftp_server` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_enable_ftp_server` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_enable_ftp_server off
| Disable the httpd_enable_homedirs SELinux Boolean | By default, the SELinux boolean `httpd_enable_homedirs` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_enable_homedirs` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_enable_homedirs off
| Disable the httpd_execmem SELinux Boolean | By default, the SELinux boolean `httpd_execmem` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_execmem` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_execmem off
| Enable the httpd_graceful_shutdown SELinux Boolean | By default, the SELinux boolean `httpd_graceful_shutdown` is enabled. If this setting is disabled, it should be enabled. To enable the `httpd_graceful_shutdown` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_graceful_shutdown on
| Disable the httpd_manage_ipa SELinux Boolean | By default, the SELinux boolean `httpd_manage_ipa` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_manage_ipa` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_manage_ipa off
| Disable the httpd_mod_auth_ntlm_winbind SELinux Boolean | By default, the SELinux boolean `httpd_mod_auth_ntlm_winbind` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_mod_auth_ntlm_winbind` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_mod_auth_ntlm_winbind off
| Disable the httpd_mod_auth_pam SELinux Boolean | By default, the SELinux boolean `httpd_mod_auth_pam` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_mod_auth_pam` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_mod_auth_pam off
| Disable the httpd_read_user_content SELinux Boolean | By default, the SELinux boolean `httpd_read_user_content` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_read_user_content` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_read_user_content off
| Disable the httpd_run_ipa SELinux Boolean | By default, the SELinux boolean `httpd_run_ipa` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_run_ipa` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_run_ipa off
| Disable the httpd_run_preupgrade SELinux Boolean | By default, the SELinux boolean `httpd_run_preupgrade` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_run_preupgrade` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_run_preupgrade off
| Disable the httpd_run_stickshift SELinux Boolean | By default, the SELinux boolean `httpd_run_stickshift` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_run_stickshift` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_run_stickshift off
| Disable the httpd_serve_cobbler_files SELinux Boolean | By default, the SELinux boolean `httpd_serve_cobbler_files` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_serve_cobbler_files` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_serve_cobbler_files off
| Disable the httpd_setrlimit SELinux Boolean | By default, the SELinux boolean `httpd_setrlimit` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_setrlimit` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_setrlimit off
| Disable the httpd_ssi_exec SELinux Boolean | By default, the SELinux boolean `httpd_ssi_exec` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_ssi_exec` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_ssi_exec off
| Disable the httpd_sys_script_anon_write SELinux Boolean | By default, the SELinux boolean `httpd_sys_script_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_sys_script_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_sys_script_anon_write off
| Disable the httpd_tmp_exec SELinux Boolean | By default, the SELinux boolean `httpd_tmp_exec` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_tmp_exec` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_tmp_exec off
| Disable the httpd_tty_comm SELinux Boolean | By default, the SELinux boolean `httpd_tty_comm` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_tty_comm` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_tty_comm off
| Disable the httpd_unified SELinux Boolean | By default, the SELinux boolean `httpd_unified` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_unified` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_unified off
| Disable the httpd_use_cifs SELinux Boolean | By default, the SELinux boolean `httpd_use_cifs` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_use_cifs` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_use_cifs off
| Disable the httpd_use_fusefs SELinux Boolean | By default, the SELinux boolean `httpd_use_fusefs` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_use_fusefs` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_use_fusefs off
| Disable the httpd_use_gpg SELinux Boolean | By default, the SELinux boolean `httpd_use_gpg` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_use_gpg` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_use_gpg off
| Disable the httpd_use_nfs SELinux Boolean | By default, the SELinux boolean `httpd_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_use_nfs off
| Disable the httpd_use_openstack SELinux Boolean | By default, the SELinux boolean `httpd_use_openstack` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_use_openstack` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_use_openstack off
| Disable the httpd_use_sasl SELinux Boolean | By default, the SELinux boolean `httpd_use_sasl` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_use_sasl` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_use_sasl off
| Disable the httpd_verify_dns SELinux Boolean | By default, the SELinux boolean `httpd_verify_dns` is disabled. If this setting is enabled, it should be disabled. To disable the `httpd_verify_dns` SELinux boolean, run the following command:
    $ sudo setsebool -P httpd_verify_dns off
| Disable the icecast_use_any_tcp_ports SELinux Boolean | By default, the SELinux boolean `icecast_use_any_tcp_ports` is disabled. If this setting is enabled, it should be disabled. To disable the `icecast_use_any_tcp_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P icecast_use_any_tcp_ports off
| Disable the irc_use_any_tcp_ports SELinux Boolean | By default, the SELinux boolean `irc_use_any_tcp_ports` is disabled. If this setting is enabled, it should be disabled. To disable the `irc_use_any_tcp_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P irc_use_any_tcp_ports off
| Disable the irssi_use_full_network SELinux Boolean | By default, the SELinux boolean `irssi_use_full_network` is disabled. If this setting is enabled, it should be disabled. To disable the `irssi_use_full_network` SELinux boolean, run the following command:
    $ sudo setsebool -P irssi_use_full_network off
| Disable the kdumpgui_run_bootloader SELinux Boolean | By default, the SELinux boolean `kdumpgui_run_bootloader` is disabled. If this setting is enabled, it should be disabled. To disable the `kdumpgui_run_bootloader` SELinux boolean, run the following command:
    $ sudo setsebool -P kdumpgui_run_bootloader off
| Enable the kerberos_enabled SELinux Boolean | By default, the SELinux boolean `kerberos_enabled` is enabled. If this setting is disabled, it should be enabled to allow confined applications to run with Kerberos. To enable the `kerberos_enabled` SELinux boolean, run the following command:
    $ sudo setsebool -P kerberos_enabled on
| Disable the ksmtuned_use_cifs SELinux Boolean | By default, the SELinux boolean `ksmtuned_use_cifs` is disabled. If this setting is enabled, it should be disabled. To disable the `ksmtuned_use_cifs` SELinux boolean, run the following command:
    $ sudo setsebool -P ksmtuned_use_cifs off
| Disable the ksmtuned_use_nfs SELinux Boolean | By default, the SELinux boolean `ksmtuned_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `ksmtuned_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P ksmtuned_use_nfs off
| Enable the logadm_exec_content SELinux Boolean | By default, the SELinux boolean `logadm_exec_content` is enabled. If this setting is disabled, it should be enabled. To enable the `logadm_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P logadm_exec_content on
| Disable the logging_syslogd_can_sendmail SELinux Boolean | By default, the SELinux boolean `logging_syslogd_can_sendmail` is disabled. If this setting is enabled, it should be disabled. To disable the `logging_syslogd_can_sendmail` SELinux boolean, run the following command:
    $ sudo setsebool -P logging_syslogd_can_sendmail off
| Disable the logging_syslogd_run_nagios_plugins SELinux Boolean | By default, the SELinux boolean `logging_syslogd_run_nagios_plugins` is disabled. If this setting is enabled, it should be disabled. To disable the `logging_syslogd_run_nagios_plugins` SELinux boolean, run the following command:
    $ sudo setsebool -P logging_syslogd_run_nagios_plugins off
| Enable the logging_syslogd_use_tty SELinux Boolean | By default, the SELinux boolean `logging_syslogd_use_tty` is enabled. If this setting is disabled, it should be enabled as it allows `syslog` the ability to read/write to terminal. To enable the `logging_syslogd_use_tty` SELinux boolean, run the following command:
    $ sudo setsebool -P logging_syslogd_use_tty on
| Enable the login_console_enabled SELinux Boolean | By default, the SELinux boolean `login_console_enabled` is enabled. If this setting is disabled, it should be enabled as it allows login from `/dev/console` to a console session. To enable the `login_console_enabled` SELinux boolean, run the following command:
    $ sudo setsebool -P login_console_enabled on
| Disable the logrotate_use_nfs SELinux Boolean | By default, the SELinux boolean `logrotate_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `logrotate_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P logrotate_use_nfs off
| Disable the logwatch_can_network_connect_mail SELinux Boolean | By default, the SELinux boolean `logwatch_can_network_connect_mail` is disabled. If this setting is enabled, it should be disabled. To disable the `logwatch_can_network_connect_mail` SELinux boolean, run the following command:
    $ sudo setsebool -P logwatch_can_network_connect_mail off
| Disable the lsmd_plugin_connect_any SELinux Boolean | By default, the SELinux boolean `lsmd_plugin_connect_any` is disabled. If this setting is enabled, it should be disabled. To disable the `lsmd_plugin_connect_any` SELinux boolean, run the following command:
    $ sudo setsebool -P lsmd_plugin_connect_any off
| Disable the mailman_use_fusefs SELinux Boolean | By default, the SELinux boolean `mailman_use_fusefs` is disabled. If this setting is enabled, it should be disabled. To disable the `mailman_use_fusefs` SELinux boolean, run the following command:
    $ sudo setsebool -P mailman_use_fusefs off
| Disable the mcelog_client SELinux Boolean | By default, the SELinux boolean `mcelog_client` is disabled. If this setting is enabled, it should be disabled. To disable the `mcelog_client` SELinux boolean, run the following command:
    $ sudo setsebool -P mcelog_client off
| Enable the mcelog_exec_scripts SELinux Boolean | By default, the SELinux boolean `mcelog_exec_scripts` is enabled. If this setting is disabled, it should be enabled. To enable the `mcelog_exec_scripts` SELinux boolean, run the following command:
    $ sudo setsebool -P mcelog_exec_scripts on
| Disable the mcelog_foreground SELinux Boolean | By default, the SELinux boolean `mcelog_foreground` is disabled. If this setting is enabled, it should be disabled. To disable the `mcelog_foreground` SELinux boolean, run the following command:
    $ sudo setsebool -P mcelog_foreground off
| Disable the mcelog_server SELinux Boolean | By default, the SELinux boolean `mcelog_server` is disabled. If this setting is enabled, it should be disabled. To disable the `mcelog_server` SELinux boolean, run the following command:
    $ sudo setsebool -P mcelog_server off
| Disable the minidlna_read_generic_user_content SELinux Boolean | By default, the SELinux boolean `minidlna_read_generic_user_content` is disabled. If this setting is enabled, it should be disabled. To disable the `minidlna_read_generic_user_content` SELinux boolean, run the following command:
    $ sudo setsebool -P minidlna_read_generic_user_content off
| Disable the mmap_low_allowed SELinux Boolean | By default, the SELinux boolean `mmap_low_allowed` is disabled. If this setting is enabled, it should be disabled. To disable the `mmap_low_allowed` SELinux boolean, run the following command:
    $ sudo setsebool -P mmap_low_allowed off
| Disable the mock_enable_homedirs SELinux Boolean | By default, the SELinux boolean `mock_enable_homedirs` is disabled. If this setting is enabled, it should be disabled. To disable the `mock_enable_homedirs` SELinux boolean, run the following command:
    $ sudo setsebool -P mock_enable_homedirs off
| Enable the mount_anyfile SELinux Boolean | By default, the SELinux boolean `mount_anyfile` is enabled. If this setting is disabled, it should be enabled to allow any file or directory to be mounted. To enable the `mount_anyfile` SELinux boolean, run the following command:
    $ sudo setsebool -P mount_anyfile on
| Disable the mozilla_plugin_bind_unreserved_ports SELinux Boolean | By default, the SELinux boolean `mozilla_plugin_bind_unreserved_ports` is disabled. If this setting is enabled, it should be disabled. To disable the `mozilla_plugin_bind_unreserved_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P mozilla_plugin_bind_unreserved_ports off
| Disable the mozilla_plugin_can_network_connect SELinux Boolean | By default, the SELinux boolean `mozilla_plugin_can_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `mozilla_plugin_can_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P mozilla_plugin_can_network_connect off
| Disable the mozilla_plugin_use_bluejeans SELinux Boolean | By default, the SELinux boolean `mozilla_plugin_use_bluejeans` is disabled. If this setting is enabled, it should be disabled. To disable the `mozilla_plugin_use_bluejeans` SELinux boolean, run the following command:
    $ sudo setsebool -P mozilla_plugin_use_bluejeans off
| Disable the mozilla_plugin_use_gps SELinux Boolean | By default, the SELinux boolean `mozilla_plugin_use_gps` is disabled. If this setting is enabled, it should be disabled. To disable the `mozilla_plugin_use_gps` SELinux boolean, run the following command:
    $ sudo setsebool -P mozilla_plugin_use_gps off
| Disable the mozilla_plugin_use_spice SELinux Boolean | By default, the SELinux boolean `mozilla_plugin_use_spice` is disabled. If this setting is enabled, it should be disabled. To disable the `mozilla_plugin_use_spice` SELinux boolean, run the following command:
    $ sudo setsebool -P mozilla_plugin_use_spice off
| Disable the mozilla_read_content SELinux Boolean | By default, the SELinux boolean `mozilla_read_content` is disabled. If this setting is enabled, it should be disabled. To disable the `mozilla_read_content` SELinux boolean, run the following command:
    $ sudo setsebool -P mozilla_read_content off
| Disable the mpd_enable_homedirs SELinux Boolean | By default, the SELinux boolean `mpd_enable_homedirs` is disabled. If this setting is enabled, it should be disabled. To disable the `mpd_enable_homedirs` SELinux boolean, run the following command:
    $ sudo setsebool -P mpd_enable_homedirs off
| Disable the mpd_use_cifs SELinux Boolean | By default, the SELinux boolean `mpd_use_cifs` is disabled. If this setting is enabled, it should be disabled. To disable the `mpd_use_cifs` SELinux boolean, run the following command:
    $ sudo setsebool -P mpd_use_cifs off
| Disable the mpd_use_nfs SELinux Boolean | By default, the SELinux boolean `mpd_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `mpd_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P mpd_use_nfs off
| Disable the mplayer_execstack SELinux Boolean | By default, the SELinux boolean `mplayer_execstack` is disabled. If this setting is enabled, it should be disabled. To disable the `mplayer_execstack` SELinux boolean, run the following command:
    $ sudo setsebool -P mplayer_execstack off
| Disable the mysql_connect_any SELinux Boolean | By default, the SELinux boolean `mysql_connect_any` is disabled. If this setting is enabled, it should be disabled. To disable the `mysql_connect_any` SELinux boolean, run the following command:
    $ sudo setsebool -P mysql_connect_any off
| Disable the nagios_run_pnp4nagios SELinux Boolean | By default, the SELinux boolean `nagios_run_pnp4nagios` is disabled. If this setting is enabled, it should be disabled. To disable the `nagios_run_pnp4nagios` SELinux boolean, run the following command:
    $ sudo setsebool -P nagios_run_pnp4nagios off
| Disable the nagios_run_sudo SELinux Boolean | By default, the SELinux boolean `nagios_run_sudo` is disabled. If this setting is enabled, it should be disabled. To disable the `nagios_run_sudo` SELinux boolean, run the following command:
    $ sudo setsebool -P nagios_run_sudo off
| Disable the named_tcp_bind_http_port SELinux Boolean | By default, the SELinux boolean `named_tcp_bind_http_port` is disabled. If this setting is enabled, it should be disabled. To disable the `named_tcp_bind_http_port` SELinux boolean, run the following command:
    $ sudo setsebool -P named_tcp_bind_http_port off
| Disable the named_write_master_zones SELinux Boolean | By default, the SELinux boolean `named_write_master_zones` is disabled. If this setting is enabled, it should be disabled. To disable the `named_write_master_zones` SELinux boolean, run the following command:
    $ sudo setsebool -P named_write_master_zones off
| Disable the neutron_can_network SELinux Boolean | By default, the SELinux boolean `neutron_can_network` is disabled. If this setting is enabled, it should be disabled. To disable the `neutron_can_network` SELinux boolean, run the following command:
    $ sudo setsebool -P neutron_can_network off
| Enable the nfs_export_all_ro SELinux Boolean | By default, the SELinux boolean `nfs_export_all_ro` is enabled. If this setting is disabled, it should be enabled as it allows NFS to export read-only mounts. To enable the `nfs_export_all_ro` SELinux boolean, run the following command:
    $ sudo setsebool -P nfs_export_all_ro on
| Enable the nfs_export_all_rw SELinux Boolean | By default, the SELinux boolean `nfs_export_all_rw` is enabled. If this setting is disabled, it should be enabled as it allows NFS to export read/write mounts. To enable the `nfs_export_all_rw` SELinux boolean, run the following command:
    $ sudo setsebool -P nfs_export_all_rw on
| Disable the nfsd_anon_write SELinux Boolean | By default, the SELinux boolean `nfsd_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `nfsd_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P nfsd_anon_write off
| Disable the nis_enabled SELinux Boolean | By default, the SELinux boolean `nis_enabled` is disabled. If this setting is enabled, it should be disabled. To disable the `nis_enabled` SELinux boolean, run the following command:
    $ sudo setsebool -P nis_enabled off
| Enable the nscd_use_shm SELinux Boolean | By default, the SELinux boolean `nscd_use_shm` is enabled. If this setting is disabled, it should be enabled to allow `nscd` to use shared memory. To enable the `nscd_use_shm` SELinux boolean, run the following command:
    $ sudo setsebool -P nscd_use_shm on
| Disable the openshift_use_nfs SELinux Boolean | By default, the SELinux boolean `openshift_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `openshift_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P openshift_use_nfs off
| Disable the openvpn_can_network_connect SELinux Boolean | By default, the SELinux boolean `openvpn_can_network_connect` is enabled. This setting should be disabled. To disable the `openvpn_can_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P openvpn_can_network_connect off
| Disable the openvpn_enable_homedirs SELinux Boolean | By default, the SELinux boolean `openvpn_enable_homedirs` is enabled. This setting should be disabled. To disable the `openvpn_enable_homedirs` SELinux boolean, run the following command:
    $ sudo setsebool -P openvpn_enable_homedirs off
| Disable the openvpn_run_unconfined SELinux Boolean | By default, the SELinux boolean `openvpn_run_unconfined` is disabled. If this setting is enabled, it should be disabled. To disable the `openvpn_run_unconfined` SELinux boolean, run the following command:
    $ sudo setsebool -P openvpn_run_unconfined off
| Disable the pcp_bind_all_unreserved_ports SELinux Boolean | By default, the SELinux boolean `pcp_bind_all_unreserved_ports` is disabled. If this setting is enabled, it should be disabled. To disable the `pcp_bind_all_unreserved_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P pcp_bind_all_unreserved_ports off
| Disable the pcp_read_generic_logs SELinux Boolean | By default, the SELinux boolean `pcp_read_generic_logs` is disabled. If this setting is enabled, it should be disabled. To disable the `pcp_read_generic_logs` SELinux boolean, run the following command:
    $ sudo setsebool -P pcp_read_generic_logs off
| Disable the piranha_lvs_can_network_connect SELinux Boolean | By default, the SELinux boolean `piranha_lvs_can_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `piranha_lvs_can_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P piranha_lvs_can_network_connect off
| Disable the polipo_connect_all_unreserved SELinux Boolean | By default, the SELinux boolean `polipo_connect_all_unreserved` is disabled. If this setting is enabled, it should be disabled. To disable the `polipo_connect_all_unreserved` SELinux boolean, run the following command:
    $ sudo setsebool -P polipo_connect_all_unreserved off
| Disable the polipo_session_bind_all_unreserved_ports SELinux Boolean | By default, the SELinux boolean `polipo_session_bind_all_unreserved_ports` is disabled. If this setting is enabled, it should be disabled. To disable the `polipo_session_bind_all_unreserved_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P polipo_session_bind_all_unreserved_ports off
| Disable the polipo_session_users SELinux Boolean | By default, the SELinux boolean `polipo_session_users` is disabled. If this setting is enabled, it should be disabled. To disable the `polipo_session_users` SELinux boolean, run the following command:
    $ sudo setsebool -P polipo_session_users off
| Disable the polipo_use_cifs SELinux Boolean | By default, the SELinux boolean `polipo_use_cifs` is disabled. If this setting is enabled, it should be disabled. To disable the `polipo_use_cifs` SELinux boolean, run the following command:
    $ sudo setsebool -P polipo_use_cifs off
| Disable the polipo_use_nfs SELinux Boolean | By default, the SELinux boolean `polipo_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `polipo_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P polipo_use_nfs off
CCE-84083-5 | Disable the polyinstantiation_enabled SELinux Boolean | By default, the SELinux boolean `polyinstantiation_enabled` is disabled. If this setting is enabled, it should be disabled. To disable the `polyinstantiation_enabled` SELinux boolean, run the following command:
    $ sudo setsebool -P polyinstantiation_enabled off
| Enable the postfix_local_write_mail_spool SELinux Boolean | By default, the SELinux boolean `postfix_local_write_mail_spool` is enabled. If this setting is disabled, it should be enabled as it allows Postfix to write to the mail spool directories. To enable the `postfix_local_write_mail_spool` SELinux boolean, run the following command:
    $ sudo setsebool -P postfix_local_write_mail_spool on
| Disable the postgresql_can_rsync SELinux Boolean | By default, the SELinux boolean `postgresql_can_rsync` is disabled. If this setting is enabled, it should be disabled. To disable the `postgresql_can_rsync` SELinux boolean, run the following command:
    $ sudo setsebool -P postgresql_can_rsync off
| Disable the postgresql_selinux_transmit_client_label SELinux Boolean | By default, the SELinux boolean `postgresql_selinux_transmit_client_label` is disabled. If this setting is enabled, it should be disabled. To disable the `postgresql_selinux_transmit_client_label` SELinux boolean, run the following command:
    $ sudo setsebool -P postgresql_selinux_transmit_client_label off
| Enable the postgresql_selinux_unconfined_dbadm SELinux Boolean | By default, the SELinux boolean `postgresql_selinux_unconfined_dbadm` is enabled. If this setting is disabled, it should be enabled as it allows Database Administrators to execute Data Manipulation Language (DML) statements. To enable the `postgresql_selinux_unconfined_dbadm` SELinux boolean, run the following command:
    $ sudo setsebool -P postgresql_selinux_unconfined_dbadm on
| Enable the postgresql_selinux_users_ddl SELinux Boolean | By default, the SELinux boolean `postgresql_selinux_users_ddl` is enabled. If this setting is disabled, it should be enabled as it allows Database Administrators to execute Data Definition Language (DDL) statements. To enable the `postgresql_selinux_users_ddl` SELinux boolean, run the following command:
    $ sudo setsebool -P postgresql_selinux_users_ddl on
| Disable the pppd_can_insmod SELinux Boolean | By default, the SELinux boolean `pppd_can_insmod` is disabled. If this setting is enabled, it should be disabled. To disable the `pppd_can_insmod` SELinux boolean, run the following command:
    $ sudo setsebool -P pppd_can_insmod off
| Disable the pppd_for_user SELinux Boolean | By default, the SELinux boolean `pppd_for_user` is disabled. If this setting is enabled, it should be disabled. To disable the `pppd_for_user` SELinux boolean, run the following command:
    $ sudo setsebool -P pppd_for_user off
| Disable the privoxy_connect_any SELinux Boolean | By default, the SELinux boolean `privoxy_connect_any` is enabled. This setting should be disabled. To disable the `privoxy_connect_any` SELinux boolean, run the following command:
    $ sudo setsebool -P privoxy_connect_any off
| Disable the prosody_bind_http_port SELinux Boolean | By default, the SELinux boolean `prosody_bind_http_port` is disabled. If this setting is enabled, it should be disabled. To disable the `prosody_bind_http_port` SELinux boolean, run the following command:
    $ sudo setsebool -P prosody_bind_http_port off
| Disable the puppetagent_manage_all_files SELinux Boolean | By default, the SELinux boolean `puppetagent_manage_all_files` is disabled. If this setting is enabled, it should be disabled. To disable the `puppetagent_manage_all_files` SELinux boolean, run the following command:
    $ sudo setsebool -P puppetagent_manage_all_files off
| Disable the puppetmaster_use_db SELinux Boolean | By default, the SELinux boolean `puppetmaster_use_db` is disabled. If this setting is enabled, it should be disabled. To disable the `puppetmaster_use_db` SELinux boolean, run the following command:
    $ sudo setsebool -P puppetmaster_use_db off
| Disable the racoon_read_shadow SELinux Boolean | By default, the SELinux boolean `racoon_read_shadow` is disabled. If this setting is enabled, it should be disabled. To disable the `racoon_read_shadow` SELinux boolean, run the following command:
    $ sudo setsebool -P racoon_read_shadow off
| Disable the rsync_anon_write SELinux Boolean | By default, the SELinux boolean `rsync_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `rsync_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P rsync_anon_write off
| Disable the rsync_client SELinux Boolean | By default, the SELinux boolean `rsync_client` is disabled. If this setting is enabled, it should be disabled. To disable the `rsync_client` SELinux boolean, run the following command:
    $ sudo setsebool -P rsync_client off
| Disable the rsync_export_all_ro SELinux Boolean | By default, the SELinux boolean `rsync_export_all_ro` is disabled. If this setting is enabled, it should be disabled. To disable the `rsync_export_all_ro` SELinux boolean, run the following command:
    $ sudo setsebool -P rsync_export_all_ro off
| Disable the rsync_full_access SELinux Boolean | By default, the SELinux boolean `rsync_full_access` is disabled. If this setting is enabled, it should be disabled. To disable the `rsync_full_access` SELinux boolean, run the following command:
    $ sudo setsebool -P rsync_full_access off
| Disable the samba_create_home_dirs SELinux Boolean | By default, the SELinux boolean `samba_create_home_dirs` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_create_home_dirs` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_create_home_dirs off
| Disable the samba_domain_controller SELinux Boolean | By default, the SELinux boolean `samba_domain_controller` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_domain_controller` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_domain_controller off
| Disable the samba_enable_home_dirs SELinux Boolean | By default, the SELinux boolean `samba_enable_home_dirs` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_enable_home_dirs` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_enable_home_dirs off
| Disable the samba_export_all_ro SELinux Boolean | By default, the SELinux boolean `samba_export_all_ro` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_export_all_ro` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_export_all_ro off
| Disable the samba_export_all_rw SELinux Boolean | By default, the SELinux boolean `samba_export_all_rw` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_export_all_rw` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_export_all_rw off
| Disable the samba_load_libgfapi SELinux Boolean | By default, the SELinux boolean `samba_load_libgfapi` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_load_libgfapi` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_load_libgfapi off
| Disable the samba_portmapper SELinux Boolean | By default, the SELinux boolean `samba_portmapper` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_portmapper` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_portmapper off
| Disable the samba_run_unconfined SELinux Boolean | By default, the SELinux boolean `samba_run_unconfined` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_run_unconfined` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_run_unconfined off
| Disable the samba_share_fusefs SELinux Boolean | By default, the SELinux boolean `samba_share_fusefs` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_share_fusefs` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_share_fusefs off
| Disable the samba_share_nfs SELinux Boolean | By default, the SELinux boolean `samba_share_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `samba_share_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P samba_share_nfs off
| Disable the sanlock_use_fusefs SELinux Boolean | By default, the SELinux boolean `sanlock_use_fusefs` is disabled. If this setting is enabled, it should be disabled. To disable the `sanlock_use_fusefs` SELinux boolean, run the following command:
    $ sudo setsebool -P sanlock_use_fusefs off
| Disable the sanlock_use_nfs SELinux Boolean | By default, the SELinux boolean `sanlock_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `sanlock_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P sanlock_use_nfs off
| Disable the sanlock_use_samba SELinux Boolean | By default, the SELinux boolean `sanlock_use_samba` is disabled. If this setting is enabled, it should be disabled. To disable the `sanlock_use_samba` SELinux boolean, run the following command:
    $ sudo setsebool -P sanlock_use_samba off
| Disable the saslauthd_read_shadow SELinux Boolean | By default, the SELinux boolean `saslauthd_read_shadow` is disabled. If this setting is enabled, it should be disabled. To disable the `saslauthd_read_shadow` SELinux boolean, run the following command:
    $ sudo setsebool -P saslauthd_read_shadow off
| Enable the secadm_exec_content SELinux Boolean | By default, the SELinux boolean `secadm_exec_content` is enabled. If this setting is disabled, it should be enabled. To enable the `secadm_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P secadm_exec_content on
| Disable the secure_mode SELinux Boolean | By default, the SELinux boolean `secure_mode` is disabled. If this setting is enabled, it should be disabled. To disable the `secure_mode` SELinux boolean, run the following command:
    $ sudo setsebool -P secure_mode off
CCE-84087-6 | Disable the secure_mode_insmod SELinux Boolean | By default, the SELinux boolean `secure_mode_insmod` is disabled. If this setting is enabled, it should be disabled. To disable the `secure_mode_insmod` SELinux boolean, run the following command:
    $ sudo setsebool -P secure_mode_insmod off
| Disable the secure_mode_policyload SELinux Boolean | By default, the SELinux boolean `secure_mode_policyload` is disabled. If this setting is enabled, it should be disabled. To disable the `secure_mode_policyload` SELinux boolean, run the following command:
    $ sudo setsebool -P secure_mode_policyload off
| Configure the selinuxuser_direct_dri_enabled SELinux Boolean | By default, the SELinux boolean `selinuxuser_direct_dri_enabled` is enabled. If XWindows is not installed or used on the system, this setting should be disabled. Otherwise, enable it. To disable the `selinuxuser_direct_dri_enabled` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_direct_dri_enabled off
CCE-84084-3 | Disable the selinuxuser_execheap SELinux Boolean | By default, the SELinux boolean `selinuxuser_execheap` is disabled. When enabled this boolean is enabled it allows selinuxusers to execute code from the heap. If this setting is enabled, it should be disabled. To disable the `selinuxuser_execheap` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_execheap off
CCE-84086-8 | Enable the selinuxuser_execmod SELinux Boolean | By default, the SELinux boolean `selinuxuser_execmod` is enabled. If this setting is disabled, it should be enabled. To enable the `selinuxuser_execmod` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_execmod on
CCE-84089-2 | disable the selinuxuser_execstack SELinux Boolean | By default, the SELinux boolean `selinuxuser_execstack` is enabled. This setting should be disabled as unconfined executables should not be able to make their stack executable. To disable the `selinuxuser_execstack` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_execstack off
| Disable the selinuxuser_mysql_connect_enabled SELinux Boolean | By default, the SELinux boolean `selinuxuser_mysql_connect_enabled` is disabled. If this setting is enabled, it should be disabled. To disable the `selinuxuser_mysql_connect_enabled` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_mysql_connect_enabled off
| Enable the selinuxuser_ping SELinux Boolean | By default, the SELinux boolean `selinuxuser_ping` is enabled. If this setting is disabled, it should be enabled as it allows confined users to use ping and traceroute which is helpful for network troubleshooting. To enable the `selinuxuser_ping` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_ping on
| Disable the selinuxuser_postgresql_connect_enabled SELinux Boolean | By default, the SELinux boolean `selinuxuser_postgresql_connect_enabled` is disabled. If this setting is enabled, it should be disabled. To disable the `selinuxuser_postgresql_connect_enabled` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_postgresql_connect_enabled off
| Disable the selinuxuser_rw_noexattrfile SELinux Boolean | By default, the SELinux boolean `selinuxuser_rw_noexattrfile` is enabled. This setting should be disabled as users should not be able to read/write files on filesystems that do not have extended attributes e.g. FAT, CDROM, FLOPPY, etc. To disable the `selinuxuser_rw_noexattrfile` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_rw_noexattrfile off
| Disable the selinuxuser_share_music SELinux Boolean | By default, the SELinux boolean `selinuxuser_share_music` is disabled. If this setting is enabled, it should be disabled. To disable the `selinuxuser_share_music` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_share_music off
| Disable the selinuxuser_tcp_server SELinux Boolean | By default, the SELinux boolean `selinuxuser_tcp_server` is disabled. If this setting is enabled, it should be disabled. To disable the `selinuxuser_tcp_server` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_tcp_server off
| Disable the selinuxuser_udp_server SELinux Boolean | By default, the SELinux boolean `selinuxuser_udp_server` is disabled. If this setting is enabled, it should be disabled. To disable the `selinuxuser_udp_server` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_udp_server off
| Disable the selinuxuser_use_ssh_chroot SELinux Boolean | By default, the SELinux boolean `selinuxuser_use_ssh_chroot` is disabled. If this setting is enabled, it should be disabled. To disable the `selinuxuser_use_ssh_chroot` SELinux boolean, run the following command:
    $ sudo setsebool -P selinuxuser_use_ssh_chroot off
| Disable the sge_domain_can_network_connect SELinux Boolean | By default, the SELinux boolean `sge_domain_can_network_connect` is disabled. If this setting is enabled, it should be disabled. To disable the `sge_domain_can_network_connect` SELinux boolean, run the following command:
    $ sudo setsebool -P sge_domain_can_network_connect off
| Disable the sge_use_nfs SELinux Boolean | By default, the SELinux boolean `sge_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `sge_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P sge_use_nfs off
| Disable the smartmon_3ware SELinux Boolean | By default, the SELinux boolean `smartmon_3ware` is disabled. If this setting is enabled, it should be disabled. To disable the `smartmon_3ware` SELinux boolean, run the following command:
    $ sudo setsebool -P smartmon_3ware off
| Disable the smbd_anon_write SELinux Boolean | By default, the SELinux boolean `smbd_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `smbd_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P smbd_anon_write off
| Disable the spamassassin_can_network SELinux Boolean | By default, the SELinux boolean `spamassassin_can_network` is disabled. If this setting is enabled, it should be disabled. To disable the `spamassassin_can_network` SELinux boolean, run the following command:
    $ sudo setsebool -P spamassassin_can_network off
| Enable the spamd_enable_home_dirs SELinux Boolean | By default, the SELinux boolean `spamd_enable_home_dirs` is enabled. If this setting is disabled, it should be enabled. To enable the `spamd_enable_home_dirs` SELinux boolean, run the following command:
    $ sudo setsebool -P spamd_enable_home_dirs on
| Disable the squid_connect_any SELinux Boolean | By default, the SELinux boolean `squid_connect_any` is enabled. This setting should be disabled as squid should only connect on specified ports. To disable the `squid_connect_any` SELinux boolean, run the following command:
    $ sudo setsebool -P squid_connect_any off
| Disable the squid_use_tproxy SELinux Boolean | By default, the SELinux boolean `squid_use_tproxy` is disabled. If this setting is enabled, it should be disabled. To disable the `squid_use_tproxy` SELinux boolean, run the following command:
    $ sudo setsebool -P squid_use_tproxy off
| Disable the ssh_chroot_rw_homedirs SELinux Boolean | By default, the SELinux boolean `ssh_chroot_rw_homedirs` is disabled. If this setting is enabled, it should be disabled. To disable the `ssh_chroot_rw_homedirs` SELinux boolean, run the following command:
    $ sudo setsebool -P ssh_chroot_rw_homedirs off
| Disable the ssh_keysign SELinux Boolean | By default, the SELinux boolean `ssh_keysign` is disabled. If this setting is enabled, it should be disabled. To disable the `ssh_keysign` SELinux boolean, run the following command:
    $ sudo setsebool -P ssh_keysign off
CCE-84081-9 | Disable the ssh_sysadm_login SELinux Boolean | By default, the SELinux boolean `ssh_sysadm_login` is disabled. If this setting is enabled, it should be disabled. To disable the `ssh_sysadm_login` SELinux boolean, run the following command:
    $ sudo setsebool -P ssh_sysadm_login off
| Enable the staff_exec_content SELinux Boolean | By default, the SELinux boolean `staff_exec_content` is enabled. If this setting is disabled, it should be enabled. To enable the `staff_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P staff_exec_content on
| Disable the staff_use_svirt SELinux Boolean | By default, the SELinux boolean `staff_use_svirt` is disabled. If this setting is enabled, it should be disabled. To disable the `staff_use_svirt` SELinux boolean, run the following command:
    $ sudo setsebool -P staff_use_svirt off
| Disable the swift_can_network SELinux Boolean | By default, the SELinux boolean `swift_can_network` is disabled. If this setting is enabled, it should be disabled. To disable the `swift_can_network` SELinux boolean, run the following command:
    $ sudo setsebool -P swift_can_network off
| Enable the sysadm_exec_content SELinux Boolean | By default, the SELinux boolean `sysadm_exec_content` is enabled. If this setting is disabled, it should be enabled. To enable the `sysadm_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P sysadm_exec_content on
| Disable the telepathy_connect_all_ports SELinux Boolean | By default, the SELinux boolean `telepathy_connect_all_ports` is disabled. If this setting is enabled, it should be disabled. To disable the `telepathy_connect_all_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P telepathy_connect_all_ports off
| Disable the telepathy_tcp_connect_generic_network_ports SELinux Boolean | By default, the SELinux boolean `telepathy_tcp_connect_generic_network_ports` is enabled. This setting should be disabled as `telepathy` should not connect to any generic network ports. To disable the `telepathy_tcp_connect_generic_network_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P telepathy_tcp_connect_generic_network_ports off
| Disable the tftp_anon_write SELinux Boolean | By default, the SELinux boolean `tftp_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `tftp_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P tftp_anon_write off
| Disable the tftp_home_dir SELinux Boolean | By default, the SELinux boolean `tftp_home_dir` is disabled. If this setting is enabled, it should be disabled. To disable the `tftp_home_dir` SELinux boolean, run the following command:
    $ sudo setsebool -P tftp_home_dir off
| Disable the tmpreaper_use_nfs SELinux Boolean | By default, the SELinux boolean `tmpreaper_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `tmpreaper_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P tmpreaper_use_nfs off
| Disable the tmpreaper_use_samba SELinux Boolean | By default, the SELinux boolean `tmpreaper_use_samba` is disabled. If this setting is enabled, it should be disabled. To disable the `tmpreaper_use_samba` SELinux boolean, run the following command:
    $ sudo setsebool -P tmpreaper_use_samba off
| Disable the tor_bind_all_unreserved_ports SELinux Boolean | By default, the SELinux boolean `tor_bind_all_unreserved_ports` is disabled. If this setting is enabled, it should be disabled. To disable the `tor_bind_all_unreserved_ports` SELinux boolean, run the following command:
    $ sudo setsebool -P tor_bind_all_unreserved_ports off
| Disable the tor_can_network_relay SELinux Boolean | By default, the SELinux boolean `tor_can_network_relay` is disabled. If this setting is enabled, it should be disabled. To disable the `tor_can_network_relay` SELinux boolean, run the following command:
    $ sudo setsebool -P tor_can_network_relay off
| Enable the unconfined_chrome_sandbox_transition SELinux Boolean | By default, the SELinux boolean `unconfined_chrome_sandbox_transition` is enabled. If this setting is disabled, it should be enabled. To enable the `unconfined_chrome_sandbox_transition` SELinux boolean, run the following command:
    $ sudo setsebool -P unconfined_chrome_sandbox_transition on
| Enable the unconfined_login SELinux Boolean | By default, the SELinux boolean `unconfined_login` is enabled. If this setting is disabled, it should be enabled. To enable the `unconfined_login` SELinux boolean, run the following command:
    $ sudo setsebool -P unconfined_login on
| Enable the unconfined_mozilla_plugin_transition SELinux Boolean | By default, the SELinux boolean `unconfined_mozilla_plugin_transition` is enabled. If this setting is disabled, it should be enabled. To enable the `unconfined_mozilla_plugin_transition` SELinux boolean, run the following command:
    $ sudo setsebool -P unconfined_mozilla_plugin_transition on
| Disable the unprivuser_use_svirt SELinux Boolean | By default, the SELinux boolean `unprivuser_use_svirt` is disabled. If this setting is enabled, it should be disabled. To disable the `unprivuser_use_svirt` SELinux boolean, run the following command:
    $ sudo setsebool -P unprivuser_use_svirt off
| Disable the use_ecryptfs_home_dirs SELinux Boolean | By default, the SELinux boolean `use_ecryptfs_home_dirs` is disabled. If this setting is enabled, it should be disabled. To disable the `use_ecryptfs_home_dirs` SELinux boolean, run the following command:
    $ sudo setsebool -P use_ecryptfs_home_dirs off
| Disable the use_fusefs_home_dirs SELinux Boolean | By default, the SELinux boolean `use_fusefs_home_dirs` is disabled. If this setting is enabled, it should be disabled. To disable the `use_fusefs_home_dirs` SELinux boolean, run the following command:
    $ sudo setsebool -P use_fusefs_home_dirs off
| Disable the use_lpd_server SELinux Boolean | By default, the SELinux boolean `use_lpd_server` is disabled. If this setting is enabled, it should be disabled. To disable the `use_lpd_server` SELinux boolean, run the following command:
    $ sudo setsebool -P use_lpd_server off
| Disable the use_nfs_home_dirs SELinux Boolean | By default, the SELinux boolean `use_nfs_home_dirs` is disabled. If this setting is enabled, it should be disabled. To disable the `use_nfs_home_dirs` SELinux boolean, run the following command:
    $ sudo setsebool -P use_nfs_home_dirs off
| Disable the use_samba_home_dirs SELinux Boolean | By default, the SELinux boolean `use_samba_home_dirs` is disabled. If this setting is enabled, it should be disabled. To disable the `use_samba_home_dirs` SELinux boolean, run the following command:
    $ sudo setsebool -P use_samba_home_dirs off
| Enable the user_exec_content SELinux Boolean | By default, the SELinux boolean `user_exec_content` is enabled. If this setting is disabled, it should be enabled. To enable the `user_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P user_exec_content on
| Disable the varnishd_connect_any SELinux Boolean | By default, the SELinux boolean `varnishd_connect_any` is disabled. If this setting is enabled, it should be disabled. To disable the `varnishd_connect_any` SELinux boolean, run the following command:
    $ sudo setsebool -P varnishd_connect_any off
| Disable the virt_read_qemu_ga_data SELinux Boolean | By default, the SELinux boolean `virt_read_qemu_ga_data` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_read_qemu_ga_data` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_read_qemu_ga_data off
| Disable the virt_rw_qemu_ga_data SELinux Boolean | By default, the SELinux boolean `virt_rw_qemu_ga_data` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_rw_qemu_ga_data` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_rw_qemu_ga_data off
| Disable the virt_sandbox_use_all_caps SELinux Boolean | By default, the SELinux boolean `virt_sandbox_use_all_caps` is enabled. This setting is disabled as containers should not run with privileges. To disable the `virt_sandbox_use_all_caps` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_sandbox_use_all_caps off
| Enable the virt_sandbox_use_audit SELinux Boolean | By default, the SELinux boolean `virt_sandbox_use_audit` is enabled. If this setting is disabled, it should be enabled to allow sandboxed containers to send audit messages. To enable the `virt_sandbox_use_audit` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_sandbox_use_audit on
| Disable the virt_sandbox_use_mknod SELinux Boolean | By default, the SELinux boolean `virt_sandbox_use_mknod` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_sandbox_use_mknod` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_sandbox_use_mknod off
| Disable the virt_sandbox_use_netlink SELinux Boolean | By default, the SELinux boolean `virt_sandbox_use_netlink` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_sandbox_use_netlink` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_sandbox_use_netlink off
| Disable the virt_sandbox_use_sys_admin SELinux Boolean | By default, the SELinux boolean `virt_sandbox_use_sys_admin` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_sandbox_use_sys_admin` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_sandbox_use_sys_admin off
| Disable the virt_transition_userdomain SELinux Boolean | By default, the SELinux boolean `virt_transition_userdomain` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_transition_userdomain` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_transition_userdomain off
| Disable the virt_use_comm SELinux Boolean | By default, the SELinux boolean `virt_use_comm` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_use_comm` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_comm off
| Disable the virt_use_execmem SELinux Boolean | By default, the SELinux boolean `virt_use_execmem` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_use_execmem` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_execmem off
| Disable the virt_use_fusefs SELinux Boolean | By default, the SELinux boolean `virt_use_fusefs` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_use_fusefs` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_fusefs off
| Disable the virt_use_nfs SELinux Boolean | By default, the SELinux boolean `virt_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_nfs off
| Disable the virt_use_rawip SELinux Boolean | By default, the SELinux boolean `virt_use_rawip` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_use_rawip` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_rawip off
| Disable the virt_use_samba SELinux Boolean | By default, the SELinux boolean `virt_use_samba` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_use_samba` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_samba off
| Disable the virt_use_sanlock SELinux Boolean | By default, the SELinux boolean `virt_use_sanlock` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_use_sanlock` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_sanlock off
| Disable the virt_use_usb SELinux Boolean | By default, the SELinux boolean `virt_use_usb` is enabled. This setting should be disabled. To disable the `virt_use_usb` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_usb off
| Disable the virt_use_xserver SELinux Boolean | By default, the SELinux boolean `virt_use_xserver` is disabled. If this setting is enabled, it should be disabled. To disable the `virt_use_xserver` SELinux boolean, run the following command:
    $ sudo setsebool -P virt_use_xserver off
| Disable the webadm_manage_user_files SELinux Boolean | By default, the SELinux boolean `webadm_manage_user_files` is disabled. If this setting is enabled, it should be disabled. To disable the `webadm_manage_user_files` SELinux boolean, run the following command:
    $ sudo setsebool -P webadm_manage_user_files off
| Disable the webadm_read_user_files SELinux Boolean | By default, the SELinux boolean `webadm_read_user_files` is disabled. If this setting is enabled, it should be disabled. To disable the `webadm_read_user_files` SELinux boolean, run the following command:
    $ sudo setsebool -P webadm_read_user_files off
| Disable the wine_mmap_zero_ignore SELinux Boolean | By default, the SELinux boolean `wine_mmap_zero_ignore` is disabled. If this setting is enabled, it should be disabled. To disable the `wine_mmap_zero_ignore` SELinux boolean, run the following command:
    $ sudo setsebool -P wine_mmap_zero_ignore off
| Disable the xdm_bind_vnc_tcp_port SELinux Boolean | By default, the SELinux boolean `xdm_bind_vnc_tcp_port` is disabled. If this setting is enabled, it should be disabled. To disable the `xdm_bind_vnc_tcp_port` SELinux boolean, run the following command:
    $ sudo setsebool -P xdm_bind_vnc_tcp_port off
| Disable the xdm_exec_bootloader SELinux Boolean | By default, the SELinux boolean `xdm_exec_bootloader` is disabled. If this setting is enabled, it should be disabled. To disable the `xdm_exec_bootloader` SELinux boolean, run the following command:
    $ sudo setsebool -P xdm_exec_bootloader off
| Disable the xdm_sysadm_login SELinux Boolean | By default, the SELinux boolean `xdm_sysadm_login` is disabled. If this setting is enabled, it should be disabled. To disable the `xdm_sysadm_login` SELinux boolean, run the following command:
    $ sudo setsebool -P xdm_sysadm_login off
| Disable the xdm_write_home SELinux Boolean | By default, the SELinux boolean `xdm_write_home` is disabled. If this setting is enabled, it should be disabled. To disable the `xdm_write_home` SELinux boolean, run the following command:
    $ sudo setsebool -P xdm_write_home off
| Disable the xen_use_nfs SELinux Boolean | By default, the SELinux boolean `xen_use_nfs` is disabled. If this setting is enabled, it should be disabled. To disable the `xen_use_nfs` SELinux boolean, run the following command:
    $ sudo setsebool -P xen_use_nfs off
| Enable the xend_run_blktap SELinux Boolean | By default, the SELinux boolean `xend_run_blktap` is enabled. If this setting is disabled, it should be enabled. To enable the `xend_run_blktap` SELinux boolean, run the following command:
    $ sudo setsebool -P xend_run_blktap on
| Enable the xend_run_qemu SELinux Boolean | By default, the SELinux boolean `xend_run_qemu` is enabled. If this setting is disabled, it should be enabled. To enable the `xend_run_qemu` SELinux boolean, run the following command:
    $ sudo setsebool -P xend_run_qemu on
| Disable the xguest_connect_network SELinux Boolean | By default, the SELinux boolean `xguest_connect_network` is enabled. This setting should be disabled as guest users should not be able to configure `NetworkManager`. To disable the `xguest_connect_network` SELinux boolean, run the following command:
    $ sudo setsebool -P xguest_connect_network off
| Disable the xguest_exec_content SELinux Boolean | By default, the SELinux boolean `xguest_exec_content` is enabled. This setting should be disabled as guest users should not be able to run executables. To disable the `xguest_exec_content` SELinux boolean, run the following command:
    $ sudo setsebool -P xguest_exec_content off
| Disable the xguest_mount_media SELinux Boolean | By default, the SELinux boolean `xguest_mount_media` is enabled. This setting should be disabled as guest users should not be able to mount any media. To disable the `xguest_mount_media` SELinux boolean, run the following command:
    $ sudo setsebool -P xguest_mount_media off
| Disable the xguest_use_bluetooth SELinux Boolean | By default, the SELinux boolean `xguest_use_bluetooth` is enabled. This setting should be disabled as guests users should not be able to access or use bluetooth. To disable the `xguest_use_bluetooth` SELinux boolean, run the following command:
    $ sudo setsebool -P xguest_use_bluetooth off
| Disable the xserver_clients_write_xshm SELinux Boolean | By default, the SELinux boolean `xserver_clients_write_xshm` is disabled. If this setting is enabled, it should be disabled. To disable the `xserver_clients_write_xshm` SELinux boolean, run the following command:
    $ sudo setsebool -P xserver_clients_write_xshm off
| Disable the xserver_execmem SELinux Boolean | By default, the SELinux boolean `xserver_execmem` is disabled. If this setting is enabled, it should be disabled. To disable the `xserver_execmem` SELinux boolean, run the following command:
    $ sudo setsebool -P xserver_execmem off
| Disable the xserver_object_manager SELinux Boolean | By default, the SELinux boolean `xserver_object_manager` is disabled. If this setting is enabled, it should be disabled. To disable the `xserver_object_manager` SELinux boolean, run the following command:
    $ sudo setsebool -P xserver_object_manager off
| Disable the zabbix_can_network SELinux Boolean | By default, the SELinux boolean `zabbix_can_network` is disabled. If this setting is enabled, it should be disabled. To disable the `zabbix_can_network` SELinux boolean, run the following command:
    $ sudo setsebool -P zabbix_can_network off
| Disable the zarafa_setrlimit SELinux Boolean | By default, the SELinux boolean `zarafa_setrlimit` is disabled. If this setting is enabled, it should be disabled. To disable the `zarafa_setrlimit` SELinux boolean, run the following command:
    $ sudo setsebool -P zarafa_setrlimit off
| Disable the zebra_write_config SELinux Boolean | By default, the SELinux boolean `zebra_write_config` is disabled. If this setting is enabled, it should be disabled. To disable the `zebra_write_config` SELinux boolean, run the following command:
    $ sudo setsebool -P zebra_write_config off
| Disable the zoneminder_anon_write SELinux Boolean | By default, the SELinux boolean `zoneminder_anon_write` is disabled. If this setting is enabled, it should be disabled. To disable the `zoneminder_anon_write` SELinux boolean, run the following command:
    $ sudo setsebool -P zoneminder_anon_write off
| Disable the zoneminder_run_sudo SELinux Boolean | By default, the SELinux boolean `zoneminder_run_sudo` is disabled. If this setting is enabled, it should be disabled. To disable the `zoneminder_run_sudo` SELinux boolean, run the following command:
    $ sudo setsebool -P zoneminder_run_sudo off
| Disable Avahi Publishing | To prevent Avahi from publishing its records, edit `/etc/avahi/avahi-daemon.conf` and ensure the following line appears in the `[publish]` section:
    disable-publishing=yes
CCE-90824-4 | Disable Avahi Server Software | The `avahi-daemon` service can be disabled with the following command:
    $ sudo systemctl mask --now avahi-daemon.service
| Disable Cockpit Management Server | The Cockpit Management Server (`cockpit`) provides a web based login and management framework. The `cockpit` service can be disabled with the following command:
    $ sudo systemctl mask --now cockpit.service
CCE-84232-8 | Disable KDump Kernel Crash Analyzer (kdump) | The `kdump` service provides a kernel crash dump analyzer. It uses the `kexec` system call to boot a secondary kernel ("capture" kernel) following a system crash, which can load information from the crashed kernel for analysis. The `kdump` service can be disabled with the following command:
    $ sudo systemctl mask --now kdump.service
CCE-84236-9 | Disable ntpdate Service (ntpdate) | The `ntpdate` service sets the local hardware clock by polling NTP servers when the system boots. It synchronizes to the NTP servers listed in `/etc/ntp/step-tickers` or `/etc/ntp.conf` and then sets the local hardware clock to the newly synchronized system time. The `ntpdate` service can be disabled with the following command:
    $ sudo systemctl mask --now ntpdate.service
CCE-84229-4 | Disable Odd Job Daemon (oddjobd) | The `oddjobd` service exists to provide an interface and access control mechanism through which specified privileged tasks can run tasks for unprivileged client applications. Communication with `oddjobd` through the system message bus. The `oddjobd` service can be disabled with the following command:
    $ sudo systemctl mask --now oddjobd.service
CCE-84231-0 | Disable Apache Qpid (qpidd) | The `qpidd` service provides high speed, secure, guaranteed delivery services. It is an implementation of the Advanced Message Queuing Protocol. By default the qpidd service will bind to port 5672 and listen for connection attempts. The `qpidd` service can be disabled with the following command:
    $ sudo systemctl mask --now qpidd.service
CCE-84237-7 | Disable Network Router Discovery Daemon (rdisc) | The `rdisc` service implements the client side of the ICMP Internet Router Discovery Protocol (IRDP), which allows discovery of routers on the local subnet. If a router is discovered then the local routing table is updated with a corresponding default route. By default this daemon is disabled. The `rdisc` service can be disabled with the following command:
    $ sudo systemctl mask --now rdisc.service
CCE-84235-1 | Disable Red Hat Network Service (rhnsd) | The Red Hat Network service automatically queries Red Hat Network servers to determine whether there are any actions that should be executed, such as package updates. This only occurs if the system was registered to an RHN server or satellite and managed as such. The `rhnsd` service can be disabled with the following command:
    $ sudo systemctl mask --now rhnsd.service
| Install the cron service | The Cron service should be installed.
| Enable cron Service | The `crond` service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The `cron` service can be enabled with the following command:
    $ sudo systemctl enable cron.service
CCE-84163-5 | Enable cron Service | The `crond` service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The `crond` service can be enabled with the following command:
    $ sudo systemctl enable crond.service
CCE-84164-3 | Disable At Service (atd) | The `at` and `batch` commands can be used to schedule tasks that are meant to be executed only once. This allows delayed execution in a manner similar to cron, except that it is not recurring. The daemon `atd` keeps track of tasks scheduled via `at` and `batch`, and executes them at the specified time. The `atd` service can be disabled with the following command:
    $ sudo systemctl mask --now atd.service
CCE-84177-5 | Verify Group Who Owns cron.d | To properly set the group owner of `/etc/cron.d`, run the command:
    $ sudo chgrp root /etc/cron.d
CCE-84170-0 | Verify Group Who Owns cron.daily | To properly set the group owner of `/etc/cron.daily`, run the command:
    $ sudo chgrp root /etc/cron.daily
CCE-84186-6 | Verify Group Who Owns cron.hourly | To properly set the group owner of `/etc/cron.hourly`, run the command:
    $ sudo chgrp root /etc/cron.hourly
CCE-84189-0 | Verify Group Who Owns cron.monthly | To properly set the group owner of `/etc/cron.monthly`, run the command:
    $ sudo chgrp root /etc/cron.monthly
CCE-84174-2 | Verify Group Who Owns cron.weekly | To properly set the group owner of `/etc/cron.weekly`, run the command:
    $ sudo chgrp root /etc/cron.weekly
CCE-84171-8 | Verify Group Who Owns Crontab | To properly set the group owner of `/etc/crontab`, run the command:
    $ sudo chgrp root /etc/crontab
CCE-84169-2 | Verify Owner on cron.d | To properly set the owner of `/etc/cron.d`, run the command:
    $ sudo chown root /etc/cron.d
CCE-84188-2 | Verify Owner on cron.daily | To properly set the owner of `/etc/cron.daily`, run the command:
    $ sudo chown root /etc/cron.daily
CCE-84168-4 | Verify Owner on cron.hourly | To properly set the owner of `/etc/cron.hourly`, run the command:
    $ sudo chown root /etc/cron.hourly
CCE-84179-1 | Verify Owner on cron.monthly | To properly set the owner of `/etc/cron.monthly`, run the command:
    $ sudo chown root /etc/cron.monthly
CCE-84190-8 | Verify Owner on cron.weekly | To properly set the owner of `/etc/cron.weekly`, run the command:
    $ sudo chown root /etc/cron.weekly
CCE-84167-6 | Verify Owner on crontab | To properly set the owner of `/etc/crontab`, run the command:
    $ sudo chown root /etc/crontab
CCE-84183-3 | Verify Permissions on cron.d | To properly set the permissions of `/etc/cron.d`, run the command:
    $ sudo chmod 0700 /etc/cron.d
CCE-84175-9 | Verify Permissions on cron.daily | To properly set the permissions of `/etc/cron.daily`, run the command:
    $ sudo chmod 0700 /etc/cron.daily
CCE-84173-4 | Verify Permissions on cron.hourly | To properly set the permissions of `/etc/cron.hourly`, run the command:
    $ sudo chmod 0700 /etc/cron.hourly
CCE-84181-7 | Verify Permissions on cron.monthly | To properly set the permissions of `/etc/cron.monthly`, run the command:
    $ sudo chmod 0700 /etc/cron.monthly
CCE-84187-4 | Verify Permissions on cron.weekly | To properly set the permissions of `/etc/cron.weekly`, run the command:
    $ sudo chmod 0700 /etc/cron.weekly
CCE-84176-7 | Verify Permissions on crontab | To properly set the permissions of `/etc/crontab`, run the command:
    $ sudo chmod 0600 /etc/crontab
CCE-86946-1 | Ensure that /etc/at.deny does not exist | The file `/etc/at.deny` should not exist. Use `/etc/at.allow` instead.
CCE-86850-5 | Ensure that /etc/cron.deny does not exist | The file `/etc/cron.deny` should not exist. Use `/etc/cron.allow` instead.
CCE-87103-8 | Verify Group Who Owns /etc/at.allow file | If `/etc/at.allow` exists, it must be group-owned by `root`. To properly set the group owner of `/etc/at.allow`, run the command:
    $ sudo chgrp root /etc/at.allow
CCE-86830-7 | Verify Group Who Owns /etc/cron.allow file | If `/etc/cron.allow` exists, it must be group-owned by `root`. To properly set the group owner of `/etc/cron.allow`, run the command:
    $ sudo chgrp root /etc/cron.allow
CCE-86844-8 | Verify User Who Owns /etc/cron.allow file | If `/etc/cron.allow` exists, it must be owned by `root`. To properly set the owner of `/etc/cron.allow`, run the command:
    $ sudo chown root /etc/cron.allow
CCE-86904-0 | Verify Permissions on /etc/at.allow file | If `/etc/at.allow` exists, it must have permissions `0600` or more restrictive. To properly set the permissions of `/etc/at.allow`, run the command:
    $ sudo chmod  /etc/at.allow
CCE-86877-8 | Verify Permissions on /etc/cron.allow file | If `/etc/cron.allow` exists, it must have permissions `0600` or more restrictive. To properly set the permissions of `/etc/cron.allow`, run the command:
    $ sudo chmod  /etc/cron.allow
| Uninstall the inet-based telnet server | The inet-based telnet daemon should be uninstalled.
| Uninstall the nis package | The support for Yellowpages should not be installed unless it is required.
| Uninstall the ntpdate package | ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
| Uninstall the ssl compliant telnet server | The `telnet` daemon, even with ssl support, should be uninstalled.
| Uninstall the telnet server | The telnet daemon should be uninstalled.
| Minimize the DHCP-Configured Options | Create the file `/etc/dhcp/dhclient.conf`, and add an appropriate setting for each of the ten configuration settings which can be obtained via DHCP. For each setting, do one of the following: If the setting should not be configured remotely by the DHCP server, select an appropriate static value, and add the line:
    supersede setting value;
If the setting should be configured remotely by the DHCP server, add the lines:
    request setting;
    require setting;
For example, suppose the DHCP server should provide only the IP address itself and the subnet mask. Then the entire file should look like:
    supersede domain-name "example.com";
    supersede domain-name-servers 192.168.1.2;
    supersede nis-domain "";
    supersede nis-servers "";
    supersede ntp-servers "ntp.example.com ";
    supersede routers 192.168.1.1;
    supersede time-offset -18000;
    request subnet-mask;
    require subnet-mask;
| Minimize Served Information | Edit /etc/dhcp/dhcpd.conf. Examine each address range section within the file, and ensure that the following options are not defined unless there is an operational need to provide this information via DHCP:
    option domain-name
    option domain-name-servers
    option nis-domain
    option nis-servers
    option ntp-servers
    option routers
    option time-offset
CCE-84240-1 | Uninstall DHCP Server Package | If the system does not need to act as a DHCP server, the dhcp package can be uninstalled. The `dhcp-server` package can be removed with the following command:
    $ sudo dnf erase dhcp-server
CCE-84241-9 | Disable DHCP Service | The `dhcpd` service should be disabled on any system that does not need to act as a DHCP server. The `dhcpd` service can be disabled with the following command:
    $ sudo systemctl mask --now dhcpd.service
| Uninstall bind Package | The `named` service is provided by the `bind` package. The `bind` package can be removed with the following command:
    $ sudo dnf erase bind
CCE-84194-0 | Disable named Service | The `named` service can be disabled with the following command:
    $ sudo systemctl mask --now named.service
CCE-84224-5 | Install fapolicyd Package | The `fapolicyd` package can be installed with the following command:
    $ sudo dnf install fapolicyd
CCE-84227-8 | Enable the File Access Policy Service | The File Access Policy service should be enabled. The `fapolicyd` service can be enabled with the following command:
    $ sudo systemctl enable fapolicyd.service
CCE-84159-3 | Uninstall vsftpd Package | The `vsftpd` package can be removed with the following command:
     $ sudo dnf erase vsftpd
CCE-84160-1 | Disable vsftpd Service | The `vsftpd` service can be disabled with the following command:
    $ sudo systemctl mask --now vsftpd.service
| Configure Firewalls to Protect the FTP Server | By default, `iptables` blocks access to the ports used by the web server. To configure `iptables` to allow port 21 traffic, one must edit `/etc/sysconfig/iptables` and `/etc/sysconfig/ip6tables` (if IPv6 is in use). Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain:
    -A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT
Edit the file `/etc/sysconfig/iptables-config`. Ensure that the space-separated list of modules contains the FTP connection tracking module:
    IPTABLES_MODULES="ip_conntrack_ftp"
| Limit Users Allowed FTP Access if Necessary | If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this access. Edit the vsftpd configuration file. Add or correct the following configuration options:
    userlist_enable=YES
    userlist_file=/etc/vsftp.ftpusers
    userlist_deny=NO
Edit the file `/etc/vsftp.ftpusers`. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name:
    USERNAME
If anonymous access is also required, add the anonymous usernames to `/etc/vsftp.ftpusers` as well.
    anonymous
    ftp
| Uninstall httpd Package | The `httpd` package can be removed with the following command:
    $ sudo dnf erase httpd
CCE-84213-8 | Disable httpd Service | The `httpd` service can be disabled with the following command:
    $ sudo systemctl mask --now httpd.service
| Set Permissions on All Configuration Files Inside /etc/httpd/conf.d/ | To properly set the permissions of `/etc/http/conf.d/*`, run the command:
    $ sudo chmod 0640 /etc/http/conf.d/*
| Set Permissions on All Configuration Files Inside /etc/httpd/conf/ | To properly set the permissions of `/etc/http/conf/*`, run the command:
    $ sudo chmod 0640 /etc/http/conf/*
| Set Permissions on All Configuration Files Inside /etc/httpd/conf.modules.d/ | To properly set the permissions of `/etc/http/conf.modules.d/*`, run the command:
    $ sudo chmod 0640 /etc/http/conf.modules.d/*
| Uninstall dovecot Package | The `dovecot` package can be removed with the following command:
    $ sudo dnf erase dovecot
CCE-84242-7 | Disable Dovecot Service | The `dovecot` service can be disabled with the following command:
    $ sudo systemctl mask --now dovecot.service
| Remove the Kerberos Server Package | The `krb5-server` package should be removed if not in use. Is this system the Kerberos server? If not, remove the package. The `krb5-server` package can be removed with the following command:
    $ sudo dnf erase krb5-server
The krb5-server RPM is not installed by default on a Red Hat Enterprise Linux 9 system. It is needed only by the Kerberos servers, not by the clients which use Kerberos for authentication. If the system is not intended for use as a Kerberos Server it should be removed.
CCE-84221-1 | Disable Kerberos by removing host keytab | Kerberos is not an approved key distribution method for Common Criteria. To prevent using Kerberos by system daemons, remove the Kerberos keytab files, especially `/etc/krb5.keytab`.
CCE-90831-9 | Ensure LDAP client is not installed | The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database. The `openldap-clients` package can be removed with the following command:
    $ sudo dnf erase openldap-clients
| Uninstall openldap-servers Package | The openldap-servers package is not installed by default on a Red Hat Enterprise Linux 9 system. It is needed only by the OpenLDAP server, not by the clients which use LDAP for authentication. If the system is not intended for use as an LDAP Server it should be removed.
CCE-87263-0 | Disable LDAP Server (slapd) | The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database.
CCE-90830-1 | Uninstall Sendmail Package | Sendmail is not the default mail transfer agent and is not installed by default. The `sendmail` package can be removed with the following command:
    $ sudo dnf erase sendmail
| Enable Postfix Service | The Postfix mail transfer agent is used for local mail delivery within the system. The default configuration only listens for connections to the default SMTP port (port 25) on the loopback interface (127.0.0.1). It is recommended to leave this service enabled for local mail delivery. The `postfix` service can be enabled with the following command:
    $ sudo systemctl enable postfix.service
CCE-90826-9 | Configure System to Forward All Mail For The Root Account | Make sure that mails delivered to root user are forwarded to a monitored email address. Make sure that the address is a valid email address reachable from the system in question. Use the following command to configure the alias:
    $ sudo echo "root: " >> /etc/aliases
    $ sudo newaliases
| Configure System to Forward All Mail through a specific host | Set up a relay host that will act as a gateway for all outbound email. Edit the file `/etc/postfix/main.cf` to ensure that only the following `relayhost` line appears:
    relayhost =
CCE-90825-1 | Disable Postfix Network Listening | Edit the file `/etc/postfix/main.cf` to ensure that only the following `inet_interfaces` line appears:
    inet_interfaces =
CCE-87232-5 | Prevent Unrestricted Mail Relaying | Modify the
    /etc/postfix/main.cf
file to restrict client connections to the local network with the following command:
    $ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'
CCE-84243-5 | Uninstall nfs-utils Package | The `nfs-utils` package can be removed with the following command:
    $ sudo dnf erase nfs-utils
| Disable Network File Systems (netfs) | The netfs script manages the boot-time mounting of several types of networked filesystems, of which NFS and Samba are the most common. If these filesystem types are not in use, the script can be disabled, protecting the system somewhat against accidental or malicious changes to `/etc/fstab` and against flaws in the netfs script itself. The `netfs` service can be disabled with the following command:
    $ sudo systemctl mask --now netfs.service
CCE-84245-0 | Disable rpcbind Service | The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The rpcbind service redirects the client to the proper port number so it can communicate with the requested service. If the system does not require RPC (such as for NFS servers) then this service should be disabled. The `rpcbind` service can be disabled with the following command:
    $ sudo systemctl mask --now rpcbind.service
CCE-90850-9 | Disable Network File System (nfs) | The Network File System (NFS) service allows remote hosts to mount and interact with shared filesystems on the local system. If the local system is not designated as a NFS server then this service should be disabled. The `nfs-server` service can be disabled with the following command:
    $ sudo systemctl mask --now nfs-server.service
| Mount Remote Filesystems with Kerberos Security | Add the `sec=krb5:krb5i:krb5p` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts.
CCE-90838-4 | Mount Remote Filesystems with nodev | Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts.
CCE-84246-8 | Mount Remote Filesystems with noexec | Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts.
CCE-84247-6 | Mount Remote Filesystems with nosuid | Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts.
| Ensure All-Squashing Disabled On All Exports | The `all_squash` maps all uids and gids to an anonymous user. This should be disabled by removing any instances of the `all_squash` option from the file `/etc/exports`.
CCE-89947-6 | Use Kerberos Security on All Exports | Using Kerberos on all exported mounts prevents a malicious client or user from impersonating a system user. To cryptography authenticate users to the NFS server, add `sec=krb5:krb5i:krb5p` to each export in `/etc/exports`.
CCE-84215-3 | The Chrony package is installed | System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them. The `chrony` package can be installed with the following command:
    $ sudo dnf install chrony
| Install the ntp service | The ntpd service should be installed.
CCE-84217-9 | The Chronyd service is enabled | chrony is a daemon which implements the Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at http://chrony.tuxfamily.org/. Chrony can be configured to be a client and/or a server. To enable Chronyd service, you can run: `# systemctl enable chronyd.service` This recommendation only applies if chrony is in use on the system.
| Enable the NTP Daemon | The `ntpd` service can be enabled with the following command:
    $ sudo systemctl enable ntpd.service
CCE-87863-7 | Enable the NTP Daemon | The `ntpd` service can be enabled with the following command:
    $ sudo systemctl enable ntpd.service
CCE-87543-5 | Disable chrony daemon from acting as server | The `port` option in `/etc/chrony.conf` can be set to `0` to make chrony daemon to never open any listening port for server operation and to operate strictly in a client-only mode.
CCE-88876-8 | Disable network management of chrony daemon | The `cmdport` option in `/etc/chrony.conf` can be set to `0` to stop chrony daemon from listening on the UDP port 323 for management connections made by chronyc.
CCE-88648-1 | Configure Time Service Maxpoll Interval | The `maxpoll` should be configured to in `/etc/ntp.conf` or `/etc/chrony.conf` to continuously poll time servers. To configure `maxpoll` in `/etc/ntp.conf` or `/etc/chrony.conf` add the following after each `server`, `pool` or `peer` entry:
    maxpoll
to
    server
directives. If using chrony any
    pool
directives should be configured too. If no `server` or `pool` directives are configured, the rule evaluates to pass.
CCE-84108-0 | Ensure that chronyd is running under chrony user account | chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at http://chrony.tuxfamily.org/. Chrony can be configured to be a client and/or a server. To ensure that chronyd is running under chrony user account, Add or edit the `OPTIONS` variable in `/etc/sysconfig/chronyd` to include `-u chrony`:
    OPTIONS="-u chrony"
This recommendation only applies if chrony is in use on the system.
CCE-87077-4 | Ensure Chrony is only configured with the server directive | Check that Chrony only has time sources configured with the `server` directive.
CCE-84218-7 | A remote time server for Chrony is configured | `Chrony` is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on `chrony` can be found at http://chrony.tuxfamily.org/. `Chrony` can be configured to be a client and/or a server. Add or edit server or pool lines to `/etc/chrony.conf` as appropriate:
    server <remote-server>
Multiple servers may be configured.
| Specify Additional Remote NTP Servers | Additional NTP servers can be specified for time synchronization in the file `/etc/ntp.conf`. To do so, add additional lines of the following form, substituting the IP address or hostname of a remote NTP server for ntpserver:
    server ntpserver
| Specify a Remote NTP Server | To specify a remote NTP server for time synchronization, edit the file `/etc/ntp.conf`. Add or correct the following lines, substituting the IP or hostname of a remote NTP server for ntpserver:
    server ntpserver
This instructs the NTP software to contact that remote server to obtain time data.
CCE-84140-3 | Ensure rsyncd service is diabled | The `rsyncd` service can be disabled with the following command:
    $ sudo systemctl mask --now rsyncd.service
CCE-84155-1 | Uninstall xinetd Package | The `xinetd` package can be removed with the following command:
    $ sudo dnf erase xinetd
CCE-84156-9 | Disable xinetd Service | The `xinetd` service can be disabled with the following command:
    $ sudo systemctl mask --now xinetd.service
CCE-84151-0 | Remove NIS Client | The Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client (`ypbind`) was used to bind a system to an NIS server and receive the distributed configuration files.
CCE-84152-8 | Uninstall ypserv Package | The `ypserv` package can be removed with the following command:
    $ sudo dnf erase ypserv
CCE-86122-9 | Disable ypserv Service | The `ypserv` service, which allows the system to act as a client in a NIS or NIS+ domain, should be disabled. The `ypserv` service can be disabled with the following command:
    $ sudo systemctl mask --now ypserv.service
CCE-84143-7 | Uninstall rsh-server Package | The `rsh-server` package can be removed with the following command:
    $ sudo dnf erase rsh-server
CCE-84142-9 | Uninstall rsh Package | The `rsh` package contains the client commands for the rsh services
CCE-88395-9 | Disable rlogin Service | The `rlogin` service, which is available with the `rsh-server` package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set `disable` to `yes` in `/etc/xinetd.d/rlogin`. The `rlogin` socket can be disabled with the following command:
    $ sudo systemctl mask --now rlogin.socket
CCE-90208-0 | Remove Host-Based Authentication Files | The `shosts.equiv` file list remote hosts and users that are trusted by the local system. To remove these files, run the following command to delete them from any location:
    $ sudo rm /[path]/[to]/[file]/shosts.equiv
CCE-84145-2 | Remove Rsh Trust Files | The files `/etc/hosts.equiv` and `~/.rhosts` (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location:
    $ sudo rm /etc/hosts.equiv
    $ rm ~/.rhosts
CCE-86532-9 | Remove User Host-Based Authentication Files | The `~/.shosts` (in each user's home directory) files list remote hosts and users that are trusted by the local system. To remove these files, run the following command to delete them from any location:
    $ sudo find / -name '.shosts' -type f -delete
CCE-84158-5 | Uninstall talk-server Package | The `talk-server` package can be removed with the following command:
     $ sudo dnf erase talk-server
CCE-84157-7 | Uninstall talk Package | The `talk` package contains the client program for the Internet talk protocol, which allows the user to chat with other users on different systems. Talk is a communication program which copies lines from one terminal to the terminal of another user. The `talk` package can be removed with the following command:
    $ sudo dnf erase talk
CCE-84149-4 | Uninstall telnet-server Package | The `telnet-server` package can be removed with the following command:
    $ sudo dnf erase telnet-server
CCE-84146-0 | Remove telnet Clients | The telnet client allows users to start connections to other systems via the telnet protocol.
CCE-84150-2 | Disable telnet Service | The `telnet` service configuration file `/etc/xinetd.d/telnet` is not created automatically. If it was created manually, check the `/etc/xinetd.d/telnet` file and ensure that `disable = no` is changed to read `disable = yes` as follows below:
    # description: The telnet server serves telnet sessions; it uses \\
    #       unencrypted username/password pairs for authentication.
    service telnet
    {
            flags           = REUSE
            socket_type     = stream

            wait            = no
            user            = root
            server          = /usr/sbin/in.telnetd
            log_on_failure  += USERID
            disable         = yes
    }
If the `/etc/xinetd.d/telnet` file does not exist, make sure that the activation of the `telnet` service on system boot is disabled via the following command: The `rexec` socket can be disabled with the following command:
    $ sudo systemctl mask --now rexec.socket
CCE-84154-4 | Uninstall tftp-server Package | The `tftp-server` package can be removed with the following command:
     $ sudo dnf erase tftp-server
CCE-84153-6 | Remove tftp Daemon | Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot files between systems. TFTP does not support authentication and can be easily hacked. The package `tftp` is a client program that allows for connections to a `tftp` server.
CCE-90736-0 | Ensure tftp Daemon Uses Secure Mode | If running the `tftp` service is necessary, it should be configured to change its root directory at startup. To do so, ensure `/etc/xinetd.d/tftp` includes `-s` as a command line argument, as shown in the following example:
    server_args = -s
CCE-90795-6 | Disable the CUPS Service | The `cups` service can be disabled with the following command:
    $ sudo systemctl mask --now cups.service
CCE-84238-5 | Uninstall squid Package | The `squid` package can be removed with the following command:
     $ sudo dnf erase squid
CCE-84239-3 | Disable Squid | The `squid` service can be disabled with the following command:
    $ sudo systemctl mask --now squid.service
| Remove the FreeRadius Server Package | The `freeradius` package should be removed if not in use. Is this system a RADIUS server? If not, remove the package. The `freeradius` package can be removed with the following command:
    $ sudo dnf erase freeradius
The freeradius RPM is not installed by default on a Red Hat Enterprise Linux 9 system. It is needed only by the RADIUS servers, not by the clients which use RADIUS for authentication. If the system is not intended for use as a RADIUS Server it should be removed.
CCE-84223-7 | Enable the Hardware RNG Entropy Gatherer Service | The Hardware RNG Entropy Gatherer service should be enabled. The `rngd` service can be enabled with the following command:
    $ sudo systemctl enable rngd.service
CCE-84191-6 | Uninstall quagga Package | The `quagga` package can be removed with the following command:
     $ sudo dnf erase quagga
| Install the Samba Common Package | The `samba-common` package should be installed. The `samba-common` package can be installed with the following command:
    $ sudo dnf install samba-common
| Require Client SMB Packet Signing, if using mount.cifs | Require packet signing of clients who mount Samba shares using the `mount.cifs` program (e.g., those who specify shares in `/etc/fstab`). To do so, ensure signing options (either `sec=krb5i` or `sec=ntlmv2i`) are used. See the `mount.cifs(8)` man page for more information. A Samba client should only communicate with servers who can support SMB packet signing.
| Uninstall Samba Package | The `samba` package can be removed with the following command:
     $ sudo dnf erase samba
CCE-84201-3 | Disable Samba | The `smb` service can be disabled with the following command:
    $ sudo systemctl mask --now smb.service
| Uninstall net-snmp Package | The `net-snmp` package provides the snmpd service. The `net-snmp` package can be removed with the following command:
    $ sudo dnf erase net-snmp
CCE-90832-7 | Disable snmpd Service | The `snmpd` service can be disabled with the following command:
    $ sudo systemctl mask --now snmpd.service
| Ensure SNMP Read Write is disabled | Edit `/etc/snmp/snmpd.conf`, remove any `rwuser` entries. Once the read write users have been removed, restart the SNMP service:
    $ sudo service snmpd restart
CCE-87293-7 | Configure SNMP Service to Use Only SNMPv3 or Newer | Edit `/etc/snmp/snmpd.conf`, removing any references to `rocommunity`, `rwcommunity`, or `com2sec`. Upon doing that, restart the SNMP service:
    $ sudo service snmpd restart
CCE-90836-8 | Install OpenSSH client software | The `openssh-clients` package can be installed with the following command:
    $ sudo dnf install openssh-clients
CCE-90823-6 | Install the OpenSSH Server Package | The `openssh-server` package should be installed. The `openssh-server` package can be installed with the following command:
    $ sudo dnf install openssh-server
| Remove the OpenSSH Server Package | The `openssh-server` package should be removed. The `openssh-server` package can be removed with the following command:
    $ sudo dnf erase openssh-server
CCE-90822-8 | Enable the OpenSSH Service | The SSH server service, sshd, is commonly needed. The `sshd` service can be enabled with the following command:
    $ sudo systemctl enable sshd.service
| Disable SSH Server If Possible (Unusual) | The SSH server service, sshd, is commonly needed. However, if it can be disabled, do so. The `sshd` service can be disabled with the following command:
    $ sudo systemctl mask --now sshd.service
This is unusual, as SSH is a common method for encrypted and authenticated remote access.
CCE-90817-8 | Verify Group Who Owns SSH Server config file | To properly set the group owner of `/etc/ssh/sshd_config`, run the command:
    $ sudo chgrp root /etc/ssh/sshd_config
CCE-90821-0 | Verify Owner on SSH Server config file | To properly set the owner of `/etc/ssh/sshd_config`, run the command:
    $ sudo chown root /etc/ssh/sshd_config
CCE-90818-6 | Verify Permissions on SSH Server config file | To properly set the permissions of `/etc/ssh/sshd_config`, run the command:
    $ sudo chmod 0600 /etc/ssh/sshd_config
CCE-90820-2 | Verify Permissions on SSH Server Private *_key Key Files | To properly set the permissions of `/etc/ssh/*_key`, run the command:
    $ sudo chmod 0600 /etc/ssh/*_key
CCE-90819-4 | Verify Permissions on SSH Server Public *.pub Key Files | To properly set the permissions of `/etc/ssh/*.pub`, run the command:
    $ sudo chmod 0644 /etc/ssh/*.pub
| Remove SSH Server iptables Firewall exception (Unusual) | By default, inbound connections to SSH's port are allowed. If the SSH server is not being used, this exception should be removed from the firewall configuration. Edit the files `/etc/sysconfig/iptables` and `/etc/sysconfig/ip6tables` (if IPv6 is in use). In each file, locate and delete the line:
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
This is unusual, as SSH is a common method for encrypted and authenticated remote access.
CCE-87522-9 | Configure session renegotiation for SSH client | The `RekeyLimit` parameter specifies how often the session key is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, put line `RekeyLimit` to file `/etc/ssh/ssh_config.d/02-rekey-limit.conf`. Make sure that there is no other `RekeyLimit` configuration preceding the `include` directive in the main config file `/etc/ssh/ssh_config`. Check also other files in `/etc/ssh/ssh_config.d` directory. Files are processed according to lexicographical order of file names. Make sure that there is no file processed before `02-rekey-limit.conf` containing definition of `RekeyLimit`.
CCE-90271-8 | Set SSH Client Alive Count Max to zero | The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered idle and terminated. To ensure the SSH idle timeout occurs precisely when the `ClientAliveInterval` is set, set the `ClientAliveCountMax` to value of `0` in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
CCE-90805-3 | Set SSH Client Alive Count Max | The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered idle and terminated. For SSH earlier than v8.2, a `ClientAliveCountMax` value of `0` causes an idle timeout precisely when the `ClientAliveInterval` is set. Starting with v8.2, a value of `0` disables the timeout functionality completely. If the option is set to a number greater than `0`, then the idle session will be disconnected after `ClientAliveInterval * ClientAliveCountMax` seconds.
CCE-90811-1 | Set SSH Idle Timeout Interval | SSH allows administrators to set an idle timeout interval. After this interval has passed, the idle user will be automatically logged out. To set an idle timeout interval, edit the following line in `/etc/ssh/sshd_config` as follows:
    ClientAliveInterval
The timeout interval is given in seconds. For example, have a timeout of 10 minutes, set interval to 600. If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made in `/etc/ssh/sshd_config`. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.
CCE-90816-0 | Disable Host-Based Authentication | SSH's cryptographic host-based authentication is more secure than `.rhosts` authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization. The default SSH configuration disables host-based authentication. The appropriate configuration is used if no value is set for `HostbasedAuthentication`. To explicitly disable host-based authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    HostbasedAuthentication no
CCE-89175-4 | Enable SSH Server firewalld Firewall Exception | By default, inbound connections to SSH's port are allowed. If the SSH server is being used but denied by the firewall, this exception should be added to the firewall configuration. To configure `firewalld` to allow access, run the following command(s): `firewall-cmd --permanent --add-service=ssh`
CCE-90812-9 | Allow Only SSH Protocol 2 | Only SSH protocol version 2 connections should be permitted. The default setting in `/etc/ssh/sshd_config` is correct, and can be verified by ensuring that the following line appears:
    Protocol 2
CCE-90801-2 | Disable Compression Or Set Compression to delayed | Compression is useful for slow network connections over long distances but can cause performance issues on local LANs. If use of compression is required, it should be enabled only after a user has authenticated; otherwise, it should be disabled. To disable compression or delay compression until after a user has successfully authenticated, add or correct the following line in the `/etc/ssh/sshd_config` file:
    Compression
CCE-90799-8 | Disable SSH Access via Empty Passwords | Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for `PermitEmptyPasswords`. To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    PermitEmptyPasswords no
Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.
CCE-90808-7 | Disable GSSAPI Authentication | Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like GSSAPI. The default SSH configuration disallows authentications based on GSSAPI. The appropriate configuration is used if no value is set for `GSSAPIAuthentication`. To explicitly disable GSSAPI authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    GSSAPIAuthentication no
CCE-90802-0 | Disable Kerberos Authentication | Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like Kerberos. The default SSH configuration disallows authentication validation through Kerberos. The appropriate configuration is used if no value is set for `KerberosAuthentication`. To explicitly disable Kerberos authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    KerberosAuthentication no
| Disable PubkeyAuthentication Authentication | Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms. To disable PubkeyAuthentication authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    PubkeyAuthentication no
CCE-90797-2 | Disable SSH Support for .rhosts Files | SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via `.rhosts` files. The default SSH configuration disables support for `.rhosts`. The appropriate configuration is used if no value is set for `IgnoreRhosts`. To explicitly disable support for .rhosts files, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    IgnoreRhosts yes
| Disable SSH Support for Rhosts RSA Authentication | SSH can allow authentication through the obsolete rsh command through the use of the authenticating user's SSH keys. This should be disabled. To ensure this behavior is disabled, add or correct the following line in `/etc/ssh/sshd_config`:
    RhostsRSAAuthentication no
CCE-90800-4 | Disable SSH Root Login | The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    PermitRootLogin no
| Disable SSH root Login with a Password (Insecure) | To disable password-based root logins over SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    PermitRootLogin prohibit-password
CCE-90806-1 | Disable SSH TCP Forwarding | The `AllowTcpForwarding` parameter specifies whether TCP forwarding is permitted. To disable TCP forwarding, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    AllowTcpForwarding no
CCE-90796-4 | Disable SSH Support for User Known Hosts | SSH can allow system users to connect to systems if a cache of the remote systems public keys is available. This should be disabled. To ensure this behavior is disabled, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    IgnoreUserKnownHosts yes
CCE-90798-0 | Disable X11 Forwarding | The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. SSH has the capability to encrypt remote X11 connections when SSH's `X11Forwarding` option is enabled. The default SSH configuration disables X11Forwarding. The appropriate configuration is used if no value is set for `X11Forwarding`. To explicitly disable X11 Forwarding, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    X11Forwarding no
CCE-90803-8 | Do Not Allow SSH Environment Options | Ensure that users are not able to override environment variables of the SSH daemon. The default SSH configuration disables environment processing. The appropriate configuration is used if no value is set for `PermitUserEnvironment`. To explicitly disable Environment options, add or correct the following `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    PermitUserEnvironment no
| Enable GSSAPI Authentication | Sites setup to use Kerberos or other GSSAPI Authenticaion require setting sshd to accept this authentication. To enable GSSAPI authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    GSSAPIAuthentication yes
CCE-86722-6 | Enable PAM | UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types. To enable PAM authentication, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    UsePAM yes
| Enable Public Key Authentication | Enable SSH login with public keys. The default SSH configuration enables authentication based on public keys. The appropriate configuration is used if no value is set for `PubkeyAuthentication`. To explicitly enable Public Key Authentication, add or correct the following `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    PubkeyAuthentication yes
CCE-90809-5 | Enable Use of Strict Mode Checking | SSHs `StrictModes` option checks file and ownership permissions in the user's home directory `.ssh` folder before accepting login. If world- writable permissions are found, logon is rejected. The default SSH configuration has `StrictModes` enabled. The appropriate configuration is used if no value is set for `StrictModes`. To explicitly enable `StrictModes` in SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    StrictModes yes
CCE-90807-9 | Enable SSH Warning Banner | To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    Banner /etc/issue
Another section contains information on how to create an appropriate system-wide warning banner.
| Enable SSH Warning Banner | To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    Banner /etc/issue.net
Another section contains information on how to create an appropriate system-wide warning banner.
| Enable Encrypted X11 Forwarding | By default, remote X11 connections are not encrypted when initiated by users. SSH has the capability to encrypt remote X11 connections when SSH's `X11Forwarding` option is enabled. To enable X11 Forwarding, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    X11Forwarding yes
| Limit Users' SSH Access | By default, the SSH configuration allows any user with an account to access the system. In order to specify the users that are allowed to login via SSH and deny all other users, add or correct the following line in the `/etc/ssh/sshd_config` file:
    AllowUsers USER1 USER2
Where `USER1` and `USER2` are valid user names.
CCE-90804-6 | Enable SSH Print Last Log | Ensure that SSH will display the date and time of the last successful account logon. The default SSH configuration enables print of the date and time of the last login. The appropriate configuration is used if no value is set for `PrintLastLog`. To explicitly enable LastLog in SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    PrintLastLog yes
CCE-90815-2 | Force frequent session key renegotiation | The `RekeyLimit` parameter specifies how often the session key of the is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    RekeyLimit
CCE-86552-7 | Ensure SSH LoginGraceTime is configured | The `LoginGraceTime` parameter to the SSH server specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate limits to ensure the service is available for needed access.
CCE-90813-7 | Set LogLevel to INFO | The INFO parameter specifices that record login and logout activity will be logged. The default SSH configuration sets the log level to INFO. The appropriate configuration is used if no value is set for `LogLevel`. To explicitly specify the log level in SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    LogLevel INFO
CCE-86923-0 | Set SSH Daemon LogLevel to VERBOSE | The `VERBOSE` parameter configures the SSH daemon to record login and logout activity. To specify the log level in SSH, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`:
    LogLevel VERBOSE
CCE-90810-3 | Set SSH authentication attempt limit | The `MaxAuthTries` parameter specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. to set MaxAUthTries edit `/etc/ssh/sshd_config` as follows:
    MaxAuthTries
CCE-84103-1 | Set SSH MaxSessions limit | The `MaxSessions` parameter specifies the maximum number of open sessions permitted from a given connection. To set MaxSessions edit `/etc/ssh/sshd_config` as follows:
    MaxSessions
CCE-87872-8 | Ensure SSH MaxStartups is configured | The MaxStartups parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. To confgure MaxStartups, you should add or correct the following line in the `/etc/ssh/sshd_config` file:
    MaxStartups
CIS recommends a MaxStartups value of '10:30:60', or more restrictive where dictated by site policy.
CCE-87681-3 | Distribute the SSH Server configuration to multiple files in a config directory. | Make sure to have the `Include /etc/ssh/sshd_config.d/*.conf` line in the `/etc/ssh/sshd_config` file. Ideally, don't have any active configuration directives in that file, and distribute the service configuration to several files in the `/etc/ssh/sshd_config.d` directory.
| Enable Use of Privilege Separation | When enabled, SSH will create an unprivileged child process that has the privilege of the authenticated user. To enable privilege separation in SSH, add or correct the following line in the `/etc/ssh/sshd_config` file:
    UsePrivilegeSeparation
CCE-88165-6 | SSH server uses strong entropy to seed | To set up SSH server to use entropy from a high-quality source, edit the `/etc/sysconfig/sshd` file. The `SSH_USE_STRONG_RNG` configuration value determines how many bytes of entropy to use, so make sure that the file contains line
    SSH_USE_STRONG_RNG=32
CCE-89105-1 | Prevent remote hosts from connecting to the proxy display | The SSH daemon should prevent remote hosts from connecting to the proxy display. The default SSH configuration for `X11UseLocalhost` is `yes`, which prevents remote hosts from connecting to the proxy display. To explicitly prevent remote connections to the proxy display, add or correct the following line in `/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf`: `X11UseLocalhost yes`
CCE-87088-1 | Certificate certificate status checking in SSSD | Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards. By configuring `certificate_verification` to `ocsp_dgst=sha1` sures that certificates for multifactor solutions are checked via Online Certificate Status Protocol (OCSP).
CCE-89737-1 | Enable Certmap in SSSD | SSSD should be configured to verify the certificate of the user or group. To set this up ensure that section like `certmap/testing.test/rule_name` is setup in `/etc/sssd/sssd.conf`. For example
    [certmap/testing.test/rule_name]
    matchrule =<SAN>.*EDIPI@mil
    maprule = (userCertificate;binary={cert!bin})
    domains = testing.test
CCE-89155-6 | Enable Smartcards in SSSD | SSSD should be configured to authenticate access to the system using smart cards. To enable smart cards in SSSD, set `pam_cert_auth` to `true` under the `[pam]` section in `/etc/sssd/sssd.conf`. For example:
    [pam]
    pam_cert_auth = true
CCE-87996-5 | Configure SSSD to Expire Offline Credentials | SSSD should be configured to expire offline credentials after 1 day. To configure SSSD to expire offline credentials, set `offline_credentials_expiration` to `1` under the `[pam]` section in `/etc/sssd/sssd.conf`. For example:
    [pam]
    offline_credentials_expiration = 1
CCE-84203-9 | Install usbguard Package | The `usbguard` package can be installed with the following command:
    $ sudo dnf install usbguard
CCE-84205-4 | Enable the USBGuard Service | The USBGuard service should be enabled. The `usbguard` service can be enabled with the following command:
    $ sudo systemctl enable usbguard.service
CCE-84206-2 | Log USBGuard daemon audit events using Linux Audit | To configure USBGuard daemon to log via Linux Audit (as opposed directly to a file), `AuditBackend` option in `/etc/usbguard/usbguard-daemon.conf` needs to be set to `LinuxAudit`.
| Authorize Human Interface Devices in USBGuard daemon | To allow authorization of Human Interface Devices (keyboard, mouse) by USBGuard daemon, add the line `allow with-interface match-all { 03:*:* }` to `/etc/usbguard/rules.conf`.
CCE-84210-4 | Authorize Human Interface Devices and USB hubs in USBGuard daemon | To allow authorization of USB devices combining human interface device and hub capabilities by USBGuard daemon, add the line `allow with-interface match-all { 03:*:* 09:00:* }` to `/etc/usbguard/rules.conf`.
| Authorize USB hubs in USBGuard daemon | To allow authorization of USB hub devices by USBGuard daemon, add line `allow with-interface match-all { 09:00:* }` to `/etc/usbguard/rules.conf`.
CCE-88882-6 | Generate USBGuard Policy | By default USBGuard when enabled prevents access to all USB devices and this lead to inaccessible system if they use USB mouse/keyboard. To prevent this scenario, the initial policy configuration must be generated based on current connected USB devices.
CCE-84104-9 | Remove the X Windows Package Group | By removing the xorg-x11-server-common package, the system no longer has X Windows installed. If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a `graphical.target` mode. To do so, run the following command:
    $ sudo dnf groupremove base-x
    $ sudo dnf remove xorg-x11-server-common
CCE-84106-4 | Disable graphical user interface | By removing the following packages, the system no longer has X Windows installed. `xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland` If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a `graphical.target` mode. To do so, run the following command:
    sudo dnf remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
CCE-84105-6 | Disable X Windows Startup By Setting Default Target | Systems that do not require a graphical user interface should only boot by default into `multi-user.target` mode. This prevents accidental booting of the system into a `graphical.target` mode. Setting the system's default target to `multi-user.target` will prevent automatic startup of the X server. To do so, run:
    $ systemctl set-default multi-user.target
You should see the following output:
    Removed symlink /etc/systemd/system/default.target.
    Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.