Rules In Pre-release Final STIG for Red Hat Enterprise Linux 7


V-ID CCI CAT Title Description Check Procedures Fixtext
RHEL-06-000001 CCI-000366 low The system must use a separate file system for /tmp. The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it. If , this is a finding. The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.
RHEL-06-000002 CCI-000366 low The system must use a separate file system for /var. Ensuring that /var is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the /var directory to contain world-writable directories installed by other software packages. If , this is a finding. The /var directory is used by daemons and other system services to store frequently-changing data. Ensure that /var has its own partition or logical volume at installation time, or migrate it using LVM.
RHEL-06-000003 CCI-000366 low The system must use a separate file system for /var/log. Placing /var/log in its own partition enables better separation between log files and other files in /var/. If , this is a finding. System logs are stored in the /var/log directory. Ensure that it has its own partition or logical volume at installation time, or migrate it using LVM.
RHEL-06-000004 CCI-000137 low The system must use a separate file system for the system audit data path. Placing /var/log/audit in its own partition enables better separation between audit files and other files, and helps ensure that auditing cannot be halted due to the partition running out of space. If , this is a finding. Audit logs are stored in the /var/log/audit directory. Ensure that it has its own partition or logical volume at installation time, or migrate it later using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon.
RHEL-06-000005 CCI-000138 medium The audit system must alert designated staff members when the audit storage volume approaches capacity. Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption. If , this is a finding. The auditd service can be configured to take an action when disk space starts to run low. Edit the file /etc/audit/auditd.conf. Modify the following line, substituting ACTION appropriately:
space_left_action = ACTION
Possible values for ACTION are described in the auditd.conf man page. These include:
  • ignore
  • syslog
  • email
  • exec
  • suspend
  • single
  • halt
Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. Acceptable values also include suspend, single, and halt.
RHEL-06-000007 CCI-000366 low The system must use a separate file system for user home directories. Ensuring that /home is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage. If , this is a finding. If user home directories will be stored locally, create a separate partition for /home at installation time (or migrate it later using LVM). If /home will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.
RHEL-06-000008 CCI-000352 high Vendor-provided cryptographic certificates must be installed to verify the integrity of system software. Changes to software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. The Red Hat GPG key is necessary to cryptographically verify packages are from Red Hat. If , this is a finding. To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them), the Red Hat GPG key must properly be installed. To install the Red Hat GPG key, run:
$ sudo rhn_register
If the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in /media/cdrom, use the following command as the root user to import it into the keyring:
$ sudo rpm --import /media/cdrom/RPM-GPG-KEY
RHEL-06-000009 CCI-000382 low The Red Hat Network Service (rhnsd) service must not be running, unless using RHN or an RHN Satellite. Although systems management and patching is extremely important to system security, management by a system outside the enterprise enclave is not desirable for some environments. However, if the system is being managed by RHN or RHN Satellite Server the rhnsd daemon can remain on. If , this is a finding. The Red Hat Network service automatically queries Red Hat Network servers to determine whether there are any actions that should be executed, such as package updates. This only occurs if the system was registered to an RHN server or satellite and managed as such. The rhnsd service can be disabled with the following command:
$ sudo systemctl disable rhnsd.service
RHEL-06-000011 CCI-001233 medium System security patches and updates must be installed and up-to-date. Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. If , this is a finding. If the system is joined to the ULN or a yum server, run the following command to install updates:
$ sudo yum update
If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded from the ULN and installed using rpm.
RHEL-06-000013 CCI-000663 medium The system package management tool must cryptographically verify the authenticity of system software packages during installation. Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.
Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.
Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA).
If , this is a finding. The gpgcheck option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check package signatures before installing them, ensure the following line appears in /etc/yum.conf in the [main] section:
gpgcheck=1
RHEL-06-000015 CCI-000663 low The system package management tool must cryptographically verify the authenticity of all software packages during installation. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA). If , this is a finding. To ensure signature checking is not disabled for any repos, remove any lines from files in /etc/yum.repos.d of the form:
gpgcheck=0
RHEL-06-000016 CCI-001069 medium A file integrity tool must be installed. The AIDE package must be installed if it is to be available for integrity checking. If , this is a finding. Install the AIDE package with the command:
$ sudo yum install aide
RHEL-06-000017 CCI-000022 medium The system must use a Linux Security Module at boot time. Disabling a major host protection feature, such as SELinux, at boot time prevents it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation. If , this is a finding. SELinux can be disabled at boot time by an argument in /etc/default/grub. Remove any instances of selinux=0 from the kernel arguments in that file to prevent SELinux from being disabled at boot.
RHEL-06-000019 CCI-001436 high There must be no .rhosts or hosts.equiv files on the system. Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system. If , this is a finding. The files /etc/hosts.equiv and ~/.rhosts (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location:
$ sudo rm /etc/hosts.equiv
$ rm ~/.rhosts
RHEL-06-000020 CCI-000022 medium The system must use a Linux Security Module configured to enforce limits on system services. Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges. If , this is a finding. The SELinux state should be set to at system boot time. In the file /etc/selinux/config, add or correct the following line to configure the system to boot into enforcing mode:
SELINUX=
RHEL-06-000023 CCI-000022 low The system must use a Linux Security Module configured to limit the privileges of system services. Setting the SELinux policy to targeted or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in permissive mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to . If , this is a finding. The SELinux targeted policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in /etc/selinux/config:
SELINUXTYPE=
Other policies, such as mls, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.
RHEL-06-000025 CCI-000022 low All device files must be monitored by the system Linux Security Module. If a device file carries the SELinux type device_t, then SELinux cannot properly restrict access to the device file. If , this is a finding. Device files, which are used for communication with important system resources, should be labeled with proper SELinux types. If any device files carry the SELinux type device_t, report the bug so that policy can be corrected. Supply information about what the device is and what programs use it.
RHEL-06-000027 CCI-000770 medium The system must prevent the root account from logging in from virtual consoles. Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account. If , this is a finding. To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in /etc/securetty:
vc/1
vc/2
vc/3
vc/4
RHEL-06-000028 CCI-000770 low The system must prevent the root account from logging in from serial consoles. Preventing direct root login to serial port interfaces helps ensure accountability for actions taken on the systems using the root account. If , this is a finding. To restrict root logins on serial ports, ensure lines of this form do not appear in /etc/securetty:
ttyS0
ttyS1
RHEL-06-000030 CCI-000366 high The system must not have accounts configured with blank or null passwords. If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments. If , this is a finding. If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the nullok option in /etc/pam.d/system-auth to prevent logins with empty passwords.
RHEL-06-000031 CCI-000366 medium The /etc/passwd file must not contain password hashes. The hashes for all user account passwords should be stored in the file /etc/shadow and never in /etc/passwd, which is readable by all users. If , this is a finding. If any password hashes are stored in /etc/passwd (in the second field, instead of an x), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely.
RHEL-06-000032 CCI-000366 medium The root account must be the only account having a UID of 0. An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner. If , this is a finding. If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed.
If the account is associated with system commands or applications the UID should be changed to one greater than "0" but less than "1000." Otherwise assign a UID greater than "1000" that has not already been assigned.
RHEL-06-000033 CCI-000366 medium The /etc/shadow file must be owned by root. The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture. If , this is a finding. To properly set the owner of /etc/shadow, run the command:
$ sudo chown root /etc/shadow
RHEL-06-000034 CCI-000366 medium The /etc/shadow file must be group-owned by root. The /etc/shadow file stores password hashes. Protection of this file is critical for system security. If , this is a finding. To properly set the group owner of /etc/shadow, run the command:
$ sudo chgrp root /etc/shadow
RHEL-06-000035 CCI-000366 medium The /etc/shadow file must have mode 0000. The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture. If , this is a finding. To properly set the permissions of /etc/shadow, run the command:
$ sudo chmod 0000 /etc/shadow
RHEL-06-000036 CCI-000366 medium The /etc/gshadow file must be owned by root. The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security. If , this is a finding. To properly set the owner of /etc/gshadow, run the command:
$ sudo chown root /etc/gshadow
RHEL-06-000037 CCI-000366 medium The /etc/gshadow file must be group-owned by root. The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security. If , this is a finding. To properly set the group owner of /etc/gshadow, run the command:
$ sudo chgrp root /etc/gshadow
RHEL-06-000038 CCI-000366 medium The /etc/gshadow file must have mode 0000. The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security. If , this is a finding. To properly set the permissions of /etc/gshadow, run the command:
$ sudo chmod 0000 /etc/gshadow
RHEL-06-000039 CCI-000366 medium The /etc/passwd file must be owned by root. The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security. If , this is a finding. To properly set the owner of /etc/passwd, run the command:
$ sudo chown root /etc/passwd
RHEL-06-000040 CCI-000366 medium The /etc/passwd file must be group-owned by root. The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security. If , this is a finding. To properly set the group owner of /etc/passwd, run the command:
$ sudo chgrp root /etc/passwd
RHEL-06-000041 CCI-000366 medium The /etc/passwd file must have mode 0644 or less permissive. If the /etc/passwd file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security. If , this is a finding. To properly set the permissions of /etc/passwd, run the command:
$ sudo chmod 0644 /etc/passwd
RHEL-06-000042 CCI-000366 medium The /etc/group file must be owned by root. The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security. If , this is a finding. To properly set the owner of /etc/group, run the command:
$ sudo chown root /etc/group
RHEL-06-000043 CCI-000366 medium The /etc/group file must be group-owned by root. The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security. If , this is a finding. To properly set the group owner of /etc/group, run the command:
$ sudo chgrp root /etc/group
RHEL-06-000044 CCI-000366 medium The /etc/group file must have mode 0644 or less permissive. The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security. If , this is a finding. To properly set the permissions of /etc/group, run the command:
$ sudo chmod 644 /etc/group
RHEL-06-000045 CCI-001499 medium Library files must have mode 0755 or less permissive. Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Restrictive permissions are necessary to protect the integrity of the system. If , this is a finding. System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
/lib
/lib64
/usr/lib
/usr/lib64
Kernel modules, which can be added to the kernel during runtime, are stored in /lib/modules. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command:
$ sudo chmod go-w FILE
RHEL-06-000046 CCI-001499 medium Library files must be owned by root. Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership is necessary to protect the integrity of the system. If , this is a finding. System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
/lib
/lib64
/usr/lib
/usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in /lib/modules. All files in these directories should be owned by the root user. If the directory, or any file in these directories, is found to be owned by a user other than root correct its ownership with the following command:
$ sudo chown root FILE
RHEL-06-000047 CCI-001499 medium All system command files must have mode 0755 or less permissive. System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted. If , this is a finding. System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command:
$ sudo chmod go-w FILE
RHEL-06-000048 CCI-001499 medium All system command files must be owned by root. System binaries are executed by privileged users as well as system services, and restrictive permissions are necessary to ensure that their execution of these programs cannot be co-opted. If , this is a finding. System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
All files in these directories should be owned by the root user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command:
$ sudo chown root FILE
RHEL-06-000050 CCI-000205 medium The system must require passwords to contain a minimum of 14 characters. Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result. If , this is a finding. To specify password length requirements for new accounts, edit the file /etc/login.defs and add or correct the following lines:
PASS_MIN_LEN 14


The DoD requirement is 14. The FISMA requirement is 12. If a program consults /etc/login.defs and also another PAM module (such as pam_pwquality) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements.
RHEL-06-000051 CCI-000198 medium Users must not be able to change passwords more than once every 24 hours. Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse. Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement. If , this is a finding. To specify password minimum age for new accounts, edit the file /etc/login.defs and add or correct the following line, replacing DAYS appropriately:
PASS_MIN_DAYS DAYS
A value of 1 day is considered for sufficient for many environments. The DoD requirement is 1.
RHEL-06-000053 CCI-000199 medium User passwords must be changed at least every 60 days. Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise. If , this is a finding. To specify password maximum age for new accounts, edit the file /etc/login.defs and add or correct the following line, replacing DAYS appropriately:
PASS_MAX_DAYS DAYS
A value of 180 days is sufficient for many environments. The DoD requirement is 60.
RHEL-06-000054 CCI-000366 low Users must be warned 7 days in advance of password expiration. Setting the password warning age enables users to make the change at a practical time. If , this is a finding. To specify how many days prior to password expiration that a warning will be issued to users, edit the file /etc/login.defs and add or correct the following line, replacing DAYS appropriately:
PASS_WARN_AGE DAYS
The DoD requirement is 7.
RHEL-06-000056 CCI-000194 low The system must require passwords to contain at least one numeric character. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space. If , this is a finding. The pam_pwquality module's dcredit parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional length credit for each digit. Modify the dcredit setting in /etc/security/pwquality.conf to require the use of a digit in passwords.
RHEL-06-000060 CCI-000195 low The system must require at least four characters be changed between the old and new passwords during a password change. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute–force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however. If , this is a finding. The pam_pwquality module's difok parameter sets the number of characters in a password that must not be present in and old password during a password change. Modify the difok setting in /etc/security/pwquality.conf to equal to require differing characters when changing passwords.
RHEL-06-000061 CCI-000044 medium The system must disable accounts after three consecutive unsuccessful login attempts. Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. If , this is a finding. To configure the system to lock out accounts after a number of incorrect login attempts using pam_faillock.so, modify the content of both /etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:

  • add the following line immediately before the pam_unix.so statement in the AUTH section:
    auth required pam_faillock.so preauth silent deny= unlock_time= fail_interval=
  • add the following line immediately after the pam_unix.so statement in the AUTH section:
    auth [default=die] pam_faillock.so authfail deny= unlock_time= fail_interval=
  • add the following line immediately before the pam_unix.so statement in the ACCOUNT section:
    account required pam_faillock.so
RHEL-06-000062 CCI-000803 medium The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (system-auth). Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kepy in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the crypt_style configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult. If , this is a finding. The PAM system service can be configured to only store encrypted representations of passwords. In /etc/pam.d/system-auth, the password section of the file controls which PAM modules execute during a password change. Set the pam_unix.so module in the password section to include the argument sha512, as shown below:
password    sufficient    pam_unix.so sha512 other arguments...

This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default.
RHEL-06-000063 CCI-000803 medium The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (login.defs). Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using a stronger hashing algorithm makes password cracking attacks more difficult. If , this is a finding. In /etc/login.defs, add or correct the following line to ensure the system will use SHA-512 as the hashing algorithm:
ENCRYPT_METHOD SHA512
RHEL-06-000064 CCI-000803 medium The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (libuser.conf). Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kepy in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the crypt_style configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult. If , this is a finding. In /etc/libuser.conf, add or correct the following line in its [defaults] section to ensure the system will use the SHA-512 algorithm for password hashing:
crypt_style = sha512
RHEL-06-000065 CCI-000366 medium The system boot loader configuration file(s) must be owned by root. Only root should be able to modify important boot parameters. If , this is a finding. The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. To properly set the owner of /boot/grub2/grub.cfg, run the command:
$ sudo chown root /boot/grub2/grub.cfg
RHEL-06-000066 CCI-000366 medium The system boot loader configuration file(s) must be group-owned by root. The root group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway. If , this is a finding. The file /boot/grub2/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. To properly set the group owner of /boot/grub2/grub.cfg, run the command:
$ sudo chgrp root /boot/grub2/grub.cfg
RHEL-06-000067 CCI-000366 medium The system boot loader configuration file(s) must have mode 0600 or less permissive. Proper permissions ensure that only the root user can modify important boot parameters. If , this is a finding. File permissions for /boot/grub2/grub.cfg should be set to 600. To properly set the permissions of /boot/grub2/grub.cfg, run the command:
$ sudo chmod 600 /boot/grub2/grub.cfg
RHEL-06-000068 CCI-000213 medium The system boot loader must require authentication. Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode. For more information on how to configure the grub2 superuser account and password, please refer to
  • https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/sec-GRUB_2_Password_Protection.html
  • .
If , this is a finding. The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings.

To do so, select a superuser account and password and add them into the appropriate grub2 configuration file(s) under /etc/grub.d. Since plaintext passwords are a security risk, generate a hash for the pasword by running the following command:
$ grub2-mkpasswd-pbkdf2
When prompted, enter the password that was selected and insert the returned password hash into the appropriate grub2 configuration file(s) under /etc/grub.d immediately after the superuser account. (Use the output from grub2-mkpasswd-pbkdf2 as the value of password-hash):
password_pbkdf2 superusers-account password-hash
NOTE: It is recommended not to use common administrator account names like root, admin, or administrator for the grub2 superuser account.
To meet FISMA Moderate, the bootloader superuser account and password MUST differ from the root account and password. Once the superuser account and password have been added, update the grub.cfg file by running:
grub2-mkconfig -o /boot/grub2/grub.cfg
NOTE: Do NOT manually add the superuser account and password to the grub.cfg file as the grub2-mkconfig command overwrites this file.
RHEL-06-000069 CCI-000213 medium The system must require authentication upon booting into single-user and maintenance modes. This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password. If , this is a finding. Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected.

By default, single-user mode is protected by requiring a password and is set in /usr/lib/systemd/system/rescue.service.
RHEL-06-000070 CCI-000213 medium The system must not permit interactive boot. Using interactive boot, the console user could disable auditing, firewalls, or other services, weakening system security. If , this is a finding. Red Hat Enterprise Linux systems support an "interactive boot" option that can be used to prevent services from being started. On a Red Hat Enterprise Linux 7 system, interactive boot can be enabled by providing a 1, yes, true, or on value to the systemd.confirm_spawn kernel argument in /etc/default/grub. Remove any instance of
systemd.confirm_spawn=(1|yes|true|on)
from the kernel arguments in that file to disable interactive boot.
RHEL-06-000071 CCI-000058 low The system must allow locking of the console screen. A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but des not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The screen package allows for a session lock to be implemented and configured. If , this is a finding. To enable console screen locking, install the screen package:
$ sudo yum install screen
Instruct users to begin new terminal sessions with the following command:
$ screen
The console can now be locked with the following key combination:
ctrl+a x
RHEL-06-000073 CCI-NaN medium The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts. Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. If , this is a finding. To configure the system login banner edit /etc/issue. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either:

You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.


OR:

I've read & consent to terms in IS user agreem't.
RHEL-06-000078 CCI-000366 medium The system must implement virtual address space randomization. Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques. If , this is a finding. To set the runtime status of the kernel.randomize_va_space kernel parameter, run the following command:
$ sudo sysctl -w kernel.randomize_va_space=2
If this is not the system's default value, add the following line to /etc/sysctl.conf:
kernel.randomize_va_space = 2
RHEL-06-000080 CCI-000366 medium The system must not send ICMPv4 redirects by default. ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers.
If , this is a finding. To set the runtime status of the net.ipv4.conf.default.send_redirects kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.default.send_redirects = 0
RHEL-06-000081 CCI-000366 medium The system must not send ICMPv4 redirects from any interface. ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers.
If , this is a finding. To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.send_redirects = 0
RHEL-06-000082 CCI-000366 medium IP forwarding for IPv4 must not be enabled, unless the system is a router. IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers. If , this is a finding. To set the runtime status of the net.ipv4.ip_forward kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.ip_forward=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.ip_forward = 0
RHEL-06-000083 CCI-000366 medium The system must not accept IPv4 source-routed packets on any interface. Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. If , this is a finding. To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.accept_source_route = 0
RHEL-06-000084 CCI-000366 medium The system must not accept ICMPv4 redirect packets on any interface. ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.
If , this is a finding. To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.accept_redirects = 0
RHEL-06-000086 CCI-000366 medium The system must not accept ICMPv4 secure redirect packets on any interface. Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required. If , this is a finding. To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.secure_redirects = 0
RHEL-06-000088 CCI-000366 low The system must log Martian packets. The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected. If , this is a finding. To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.all.log_martians=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.log_martians = 1
RHEL-06-000089 CCI-000366 medium The system must not accept IPv4 source-routed packets by default. Source-routed packates allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.
If , this is a finding. To set the runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.default.accept_source_route = 0
RHEL-06-000090 CCI-000366 medium The system must not accept ICMPv4 secure redirect packets by default. Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required. If , this is a finding. To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.default.secure_redirects = 0
RHEL-06-000091 CCI-000366 low The system must ignore IPv4 ICMP redirect messages. ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.
If , this is a finding. To set the runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.default.accept_redirects = 0
RHEL-06-000092 CCI-000366 low The system must not respond to ICMPv4 sent to a broadcast address. Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.
Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.
If , this is a finding. To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.icmp_echo_ignore_broadcasts = 1
RHEL-06-000093 CCI-000366 low The system must ignore ICMPv4 bogus error responses. Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged. If , this is a finding. To set the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.icmp_ignore_bogus_error_responses = 1
RHEL-06-000095 CCI-001095 medium The system must be configured to use TCP syncookies when experiencing a TCP SYN flood. A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests. If , this is a finding. To set the runtime status of the net.ipv4.tcp_syncookies kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.tcp_syncookies=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.tcp_syncookies = 1
RHEL-06-000096 CCI-000366 medium The system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces. Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks. If , this is a finding. To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.rp_filter = 1
RHEL-06-000097 CCI-000366 medium The system must use a reverse-path filter for IPv4 network traffic when possible by default. Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks. If , this is a finding. To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.default.rp_filter = 1
RHEL-06-000098 CCI-000366 medium The IPv6 protocol handler must not be bound to the network stack unless needed. Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation. If , this is a finding. To disable support for (ipv6) add the following line to /etc/sysctl.d/ipv6.conf (or another file in /etc/sysctl.d):
net.ipv6.conf.all.disable_ipv6 = 1
This disables IPv6 on all network interfaces as other services and system functionality require the IPv6 stack loaded to work.
RHEL-06-000099 CCI-000366 medium The system must ignore ICMPv6 redirects by default. An illicit ICMP redirect message could result in a man-in-the-middle attack. If , this is a finding. To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter, run the following command:
$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv6.conf.default.accept_redirects = 0
RHEL-06-000103 CCI-001118 medium The system must employ a local IPv6 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000105 CCI-001117 medium The system must employ a local IPv6 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000106 CCI-001098 medium The system must employ a local IPv6 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000107 CCI-001100 medium The system must employ a local IPv6 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000108 CCI-001097 medium The system must employ a local IPv6 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000109 CCI-001414 medium The system must employ a local IPv6 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000113 CCI-001118 medium The system must employ a local IPv4 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000115 CCI-001117 medium The system must employ a local IPv4 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000116 CCI-001098 medium The system must employ a local IPv4 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000117 CCI-001100 medium The system must employ a local IPv4 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000118 CCI-001097 medium The system must employ a local IPv4 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000119 CCI-001414 medium The system must employ a local IPv4 firewall. Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. If , this is a finding. The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service
RHEL-06-000120 CCI-000066 medium The system's local IPv4 firewall must implement a deny-all, allow-by-exception policy for inbound packets. In firewalld the default zone is applied only after all the applicable rules in the table are examined for a match. Setting the default zone to drop implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted. If , this is a finding. To set the default zone to drop for the built-in default zone which processes incoming IPv4 and IPv6 packets, modify the following line in /etc/firewalld/firewalld.conf to be:
DefaultZone=drop
RHEL-06-000121 CCI-001115 medium The system's local firewall must implement a deny-all, allow-by-exception policy for inbound packets. In firewalld the default zone is applied only after all the applicable rules in the table are examined for a match. Setting the default zone to drop implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted. If , this is a finding. To set the default zone to drop for the built-in default zone which processes incoming IPv4 and IPv6 packets, modify the following line in /etc/firewalld/firewalld.conf to be:
DefaultZone=drop
RHEL-06-000122 CCI-001154 medium The system's local firewall must implement a deny-all, allow-by-exception policy for inbound packets. In firewalld the default zone is applied only after all the applicable rules in the table are examined for a match. Setting the default zone to drop implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted. If , this is a finding. To set the default zone to drop for the built-in default zone which processes incoming IPv4 and IPv6 packets, modify the following line in /etc/firewalld/firewalld.conf to be:
DefaultZone=drop
RHEL-06-000124 CCI-000382 medium The Datagram Congestion Control Protocol (DCCP) must be disabled unless required. Disabling DCCP protects the system against exploitation of any flaws in its implementation. If , this is a finding. The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the dccp kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:
install dccp /bin/true
RHEL-06-000125 CCI-000382 medium The Stream Control Transmission Protocol (SCTP) must be disabled unless required. Disabling SCTP protects the system against exploitation of any flaws in its implementation. If , this is a finding. The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the sctp kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:
install sctp /bin/true
RHEL-06-000133 CCI-001314 medium All rsyslog-generated log files must be owned by root. The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access. If , this is a finding. The owner of all log files written by rsyslog should be root. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's owner:
$ ls -l LOGFILE
If the owner is not root, run the following command to correct this:
$ sudo chown root LOGFILE
RHEL-06-000134 CCI-001314 medium All rsyslog-generated log files must be group-owned by root. The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access. If , this is a finding. The group-owner of all log files written by rsyslog should be root. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's group owner:
$ ls -l LOGFILE
If the owner is not root, run the following command to correct this:
$ sudo chgrp root LOGFILE
RHEL-06-000135 CCI-001314 medium All rsyslog-generated log files must have mode 0600 or less permissive. Log files can contain valuable information regarding system configuration. If the system log files are not protected unauthorized users could change the logged data, eliminating their forensic value. If , this is a finding. The file permissions for all log files written by rsyslog should be set to 600, or more restrictive. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's permissions:
$ ls -l LOGFILE
If the permissions are not 600 or more restrictive, run the following command to correct this:
$ sudo chmod 0600 LOGFILE
RHEL-06-000136 CCI-001348 medium The operating system must back up audit records on an organization defined frequency onto a different system or media than the system being audited. A log server (loghost) receives syslog messages from one or more systems. This data can be used as an additional log source in the event a system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise. If , this is a finding. To configure rsyslog to send logs to a remote log server, open /etc/rsyslog.conf and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting loghost.example.com appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments.
To use UDP for log message delivery:
*.* @loghost.example.com

To use TCP for log message delivery:
*.* @@loghost.example.com

To use RELP for log message delivery:
*.* :omrelp:loghost.example.com
RHEL-06-000137 CCI-000136 medium The operating system must support the requirement to centrally manage the content of audit records generated by organization defined information system components. A log server (loghost) receives syslog messages from one or more systems. This data can be used as an additional log source in the event a system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise. If , this is a finding. To configure rsyslog to send logs to a remote log server, open /etc/rsyslog.conf and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting loghost.example.com appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments.
To use UDP for log message delivery:
*.* @loghost.example.com

To use TCP for log message delivery:
*.* @@loghost.example.com

To use RELP for log message delivery:
*.* :omrelp:loghost.example.com
RHEL-06-000138 CCI-000366 low System logs must be rotated daily. Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full. If , this is a finding. The logrotate utility allows for the automatic rotation of log files. The frequency of rotation is specified in /etc/logrotate.conf, which triggers a cron task. To configure logrotate to run daily, add or correct the following line in /etc/logrotate.conf:
# rotate log files frequency
daily
RHEL-06-000139 CCI-000347 medium Auditing must be implemented. Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.
If , this is a finding. The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:
$ sudo systemctl enable auditd.service
RHEL-06-000140 CCI-000157 medium The operating system audit records must be able to be used by a report generation capability. The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000142 CCI-000880 medium The operating system must audit nonlocal maintenance and diagnostic sessions. Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.
If , this is a finding. The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:
$ sudo systemctl enable auditd.service
RHEL-06-000143 CCI-001353 medium The operating system must produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format. Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.
If , this is a finding. The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:
$ sudo systemctl enable auditd.service
RHEL-06-000145 CCI-001487 medium The operating system must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event. Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.
If , this is a finding. The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:
$ sudo systemctl enable auditd.service
RHEL-06-000148 CCI-000067 medium The operating system must employ automated mechanisms to facilitate the monitoring and control of remote access methods. Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.
If , this is a finding. The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:
$ sudo systemctl enable auditd.service
RHEL-06-000149 CCI-000158 medium The operating system must provide the capability to automatically process audit records for events of interest based upon selectable, event criteria. Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.
If , this is a finding. The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:
$ sudo systemctl enable auditd.service
RHEL-06-000151 CCI-001190 medium The operating system must fail to an organization defined known state for organization defined types of failures. Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.
If , this is a finding. The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:
$ sudo systemctl enable auditd.service
RHEL-06-000154 CCI-000130 medium The operating system must produce audit records containing sufficient information to establish what type of events occurred. Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.
If , this is a finding. The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:
$ sudo systemctl enable auditd.service
RHEL-06-000157 CCI-001464 low Auditing must be enabled at boot by setting a kernel parameter. Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot. If , this is a finding. To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument audit=1 to the default GRUB 2 command line for the Linux operating system in /etc/default/grub, in the manner below:
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1"
RHEL-06-000159 CCI-000366 medium The system must retain enough rotated audit logs to cover the required log retention period. The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained. If , this is a finding. Determine how many log files auditd should retain when it rotates logs. Edit the file /etc/audit/auditd.conf. Add or modify the following line, substituting NUMLOGS with the correct value of :
num_logs = NUMLOGS
Set the value to 5 for general-purpose systems. Note that values less than 2 result in no log rotation.
RHEL-06-000160 CCI-000366 medium The system must set a maximum audit log file size. The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained. If , this is a finding. Determine the amount of audit data (in megabytes) which should be retained in each log file. Edit the file /etc/audit/auditd.conf. Add or modify the following line, substituting the correct value of for STOREMB:
max_log_file = STOREMB
Set the value to 6 (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data.
RHEL-06-000161 CCI-000366 medium The system must rotate audit log files that reach the maximum file size. Automatically rotating logs (by setting this to rotate) minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, keep_logs can be employed. If , this is a finding. The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by auditd, add or correct the line in /etc/audit/auditd.conf:
max_log_file_action = ACTION
Possible values for ACTION are described in the auditd.conf man page. These include:
  • ignore
  • syslog
  • suspend
  • rotate
  • keep_logs
Set the ACTION to rotate to ensure log rotation occurs. This is the default. The setting is case-insensitive.
RHEL-06-000165 CCI-000169 low The audit system must be configured to audit all attempts to alter system time through adjtimex. Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules
RHEL-06-000167 CCI-000169 low The audit system must be configured to audit all attempts to alter system time through settimeofday. Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules
RHEL-06-000169 CCI-000169 low The audit system must be configured to audit all attempts to alter system time through stime. Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d for both 32 bit and 64 bit systems:
-a always,exit -F arch=b32 -S stime -k audit_time_rules
Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file for both 32 bit and 64 bit systems:
-a always,exit -F arch=b32 -S stime -k audit_time_rules
Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined system calls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules
RHEL-06-000171 CCI-000169 low The audit system must be configured to audit all attempts to alter system time through clock_settime. Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules
RHEL-06-000173 CCI-000169 low The audit system must be configured to audit all attempts to alter system time through /etc/localtime. Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-w /etc/localtime -p wa -k audit_time_rules
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-w /etc/localtime -p wa -k audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used.
RHEL-06-000174 CCI-000018 low The operating system must automatically audit account creation. In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file, in order to capture events that modify account changes:
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
RHEL-06-000175 CCI-001403 low The operating system must automatically audit account modification. In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file, in order to capture events that modify account changes:
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
RHEL-06-000176 CCI-001404 low The operating system must automatically audit account disabling actions. In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file, in order to capture events that modify account changes:
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
RHEL-06-000177 CCI-001405 low The operating system must automatically audit account termination. In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file, in order to capture events that modify account changes:
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
RHEL-06-000182 CCI-000366 low The audit system must be configured to audit modifications to the systems network configuration. The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as appropriate for your system:
-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file, setting ARCH to either b32 or b64 as appropriate for your system:
-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
RHEL-06-000183 CCI-000366 low The audit system must be configured to audit modifications to the system's Mandatory Access Control (MAC) configuration (SELinux). The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-w /etc/selinux/ -p wa -k MAC-policy
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-w /etc/selinux/ -p wa -k MAC-policy
RHEL-06-000184 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using chmod. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S chmod  -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S chmod  -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000185 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using chown. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000186 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using fchmod. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000187 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using fchmodat. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000188 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using fchown. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000189 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using fchownat. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000190 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using fremovexattr. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000191 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using fsetxattr. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000192 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using lchown. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000193 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using lremovexattr. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000194 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using lsetxattr. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000195 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using removexattr. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000196 CCI-000172 low The audit system must be configured to audit all discretionary access control permission modifications using setxattr. The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. If , this is a finding. At a minimum the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following line:
-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
RHEL-06-000197 CCI-000172 low The audit system must be configured to audit failed attempts to access files and programs. Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise. If , this is a finding. At a minimum the audit system should collect unauthorized file accesses for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
If the system is 64 bit then also add the following lines:
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
If the system is 64 bit then also add the following lines:
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
RHEL-06-000198 CCI-000040 low The audit system must be configured to audit all use of setuid programs. Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threast.
Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
If , this is a finding. At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid / setgid programs, run the following command for each local partition PART:
$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null
If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix .rules in the directory /etc/audit/rules.d for each setuid / setgid program on the system, replacing the SETUID_PROG_PATH part with the full path of that setuid / setgid program in the list:
-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules for each setuid / setgid program on the system, replacing the SETUID_PROG_PATH part with the full path of that setuid / setgid program in the list:
-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
RHEL-06-000199 CCI-000172 low The audit system must be configured to audit successful file system mounts. The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss. If , this is a finding. At a minimum the audit system should collect media exportation events for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as appropriate for your system:
-a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=4294967295 -k export
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file, setting ARCH to either b32 or b64 as appropriate for your system:
-a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=4294967295 -k export
RHEL-06-000201 CCI-000172 low The audit system must be configured to audit changes to the "/etc/sudoers" file. The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes. If , this is a finding. At a minimum the audit system should collect administrator actions for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:
-w /etc/sudoers -p wa -k actions
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:
-w /etc/sudoers -p wa -k actions
RHEL-06-000202 CCI-000172 medium The audit system must be configured to audit the loading and unloading of dynamic kernel modules. The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel. If , this is a finding. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
-w /usr/sbin/insmod -p x -k modules
-w /usr/sbin/rmmod -p x -k modules
-w /usr/sbin/modprobe -p x -k modules
-a always,exit -F arch=ARCH -S init_module -S delete_module -k modules
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file in order to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
-w /usr/sbin/insmod -p x -k modules
-w /usr/sbin/rmmod -p x -k modules
-w /usr/sbin/modprobe -p x -k modules
-a always,exit -F arch=ARCH -S init_module -S delete_module -k modules
RHEL-06-000203 CCI-000382 medium The xinetd service must be disabled if no network services utilizing it are enabled. The xinetd service provides a dedicated listener service for some programs, which is no longer necessary for commonly-used network services. Disabling it ensures that these uncommon services are not running, and also prevents attacks against xinetd itself. If , this is a finding. The xinetd service can be disabled with the following command:
$ sudo systemctl disable xinetd.service
RHEL-06-000204 CCI-000382 low The xinetd service must be uninstalled if no network services utilizing it are enabled. Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation. If , this is a finding. The xinetd package can be uninstalled with the following command:
$ sudo yum erase xinetd
RHEL-06-000211 CCI-000888 high The telnet daemon must not be running. The telnet protocol uses unencrypted network communication, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. The telnet protocol is also subject to man-in-the-middle attacks. If , this is a finding. The telnet service configuration file /etc/xinetd.d/telnet is not created automatically. If it was created manually, check the /etc/xinetd.d/telnet file and ensure that disable = no is changed to read disable = yes as follows below:
# description: The telnet server serves telnet sessions; it uses \\
#       unencrypted username/password pairs for authentication.
service telnet
{
        flags           = REUSE
        socket_type     = stream

        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure  += USERID
        disable         = yes
}
If the /etc/xinetd.d/telnet file does not exist, make sure that the activation of the telnet service on system boot is disabled via the following command: The rexec socket can be disabled with the following command:
$ sudo systemctl disable rexec.socket
RHEL-06-000213 CCI-000381 high The rsh-server package must not be installed. The rsh-server service provides unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication. If a privileged user were to login using this service, the privileged user password could be compromised. The rsh-server package provides several obsolete and insecure network services. Removing it decreases the risk of those services' accidental (or intentional) activation. If , this is a finding. The rsh-server package can be uninstalled with the following command:
$ sudo yum erase rsh-server
RHEL-06-000214 CCI-000068 high The rshd service must not be running. The rsh service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. If , this is a finding. The rsh service, which is available with the rsh-server package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set disable to yes in /etc/xinetd.d/rsh. If using systemd, The rsh socket can be disabled with the following command:
$ sudo systemctl disable rsh.socket
RHEL-06-000216 CCI-000068 high The rexecd service must not be running. The rexec service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. If , this is a finding. The rexec service, which is available with the rsh-server package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set disable to yes in /etc/xinetd.d/rexec. If using systemd, The rexec socket can be disabled with the following command:
$ sudo systemctl disable rexec.socket
RHEL-06-000218 CCI-001436 high The rlogind service must not be running. The rlogin service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. If , this is a finding. The rlogin service, which is available with the rsh-server package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set disable to yes in /etc/xinetd.d/rlogin. If using systemd, The rlogin socket can be disabled with the following command:
$ sudo systemctl disable rlogin.socket
RHEL-06-000220 CCI-000381 medium The ypserv package must not be installed. The NIS service provides an unencrypted authentication service which does not provide for the confidentiality and integrity of user passwords or the remote session. Removing the ypserv package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services. If , this is a finding. The ypserv package can be uninstalled with the following command:
$ sudo yum erase ypserv
RHEL-06-000221 CCI-000382 medium The ypbind service must not be running. Disabling the ypbind service ensures the system is not acting as a client in a NIS or NIS+ domain. If , this is a finding. The ypbind service, which allows the system to act as a client in a NIS or NIS+ domain, should be disabled. The ypbind service can be disabled with the following command:
$ sudo systemctl disable ypbind.service
RHEL-06-000222 CCI-000381 medium The tftp-server package must not be installed. Removing the tftp-server package decreases the risk of the accidental (or intentional) activation of tftp services. If TFTP is required for operational support (such as transmission of router configurations), its use must be documented with the Information Systems Securty Manager (ISSM), restricted to only authorized personnel, and have access control rules established. If , this is a finding. The tftp-server package can be removed with the following command:
$ sudo yum erase tftp-server
RHEL-06-000223 CCI-001436 medium The TFTP service must not be running. Disabling the tftp service ensures the system is not acting as a TFTP server, which does not provide encryption or authentication. If , this is a finding. The tftp service should be disabled. The tftp service can be disabled with the following command:
$ sudo systemctl disable tftp.service
RHEL-06-000224 CCI-000366 medium The cron service must be running. Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential. If , this is a finding. The crond service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The crond service can be enabled with the following command:
$ sudo systemctl enable crond.service
RHEL-06-000227 CCI-000774 high The SSH daemon must be configured to use only the SSHv2 protocol. SSH protocol version 1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system. If , this is a finding. Only SSH protocol version 2 connections should be permitted. The default setting in /etc/ssh/sshd_config is correct, and can be verified by ensuring that the following line appears:
Protocol 2
RHEL-06-000230 CCI-001133 low The SSH daemon must set a timeout interval on idle sessions. Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended. If , this is a finding. SSH allows administrators to set an idle timeout interval. After this interval has passed, the idle user will be automatically logged out.

To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as follows:
ClientAliveInterval interval
The timeout interval is given in seconds. To have a timeout of 10 minutes, set interval to 600.

If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made here. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.
RHEL-06-000231 CCI-000879 low The SSH daemon must set a timeout count on idle sessions. This ensures a user login will be terminated as soon as the ClientAliveCountMax is reached. If , this is a finding. To ensure the SSH idle timeout occurs precisely when the ClientAliveCountMax is set, edit /etc/ssh/sshd_config as follows:
ClientAliveCountMax 0
RHEL-06-000234 CCI-000766 medium The SSH daemon must ignore .rhosts files. SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. If , this is a finding. SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via .rhosts files.

To ensure this behavior is disabled, add or correct the following line in /etc/ssh/sshd_config:
IgnoreRhosts yes
RHEL-06-000235 CCI-000765 medium The SSH daemon must not allow host-based authentication. SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. If , this is a finding. SSH's cryptographic host-based authentication is more secure than .rhosts authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization.

To disable host-based authentication, add or correct the following line in /etc/ssh/sshd_config:
HostbasedAuthentication no
RHEL-06-000236 CCI-000766 medium The SSH daemon must not allow host-based authentication. SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. If , this is a finding. SSH's cryptographic host-based authentication is more secure than .rhosts authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization.

To disable host-based authentication, add or correct the following line in /etc/ssh/sshd_config:
HostbasedAuthentication no
RHEL-06-000237 CCI-000770 medium The system must not permit root logins using remote access programs such as ssh. Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password. If , this is a finding. The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config:
PermitRootLogin no
RHEL-06-000239 CCI-000766 high The SSH daemon must not allow authentication using an empty password. Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere. If , this is a finding. To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in /etc/ssh/sshd_config:
PermitEmptyPasswords no

Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.
RHEL-06-000240 CCI-000048 medium The SSH daemon must be configured with the Department of Defense (DoD) login banner. The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution. If , this is a finding. To enable the warning banner and ensure it is consistent across the system, add or correct the following line in /etc/ssh/sshd_config:
Banner /etc/issue
Another section contains information on how to create an appropriate system-wide warning banner.
RHEL-06-000241 CCI-001414 low The SSH daemon must not permit user environment settings. SSH environment options potentially allow users to bypass access restriction in some configurations. If , this is a finding. To ensure users are not able to override environment options to the SSH daemon, add or correct the following line in /etc/ssh/sshd_config:
PermitUserEnvironment no
RHEL-06-000243 CCI-001144 medium The SSH daemon must be configured to use only FIPS 140-2 approved ciphers. Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.
Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets industry and government requirements. For government systems, this allows Security Levels 1, 2, 3, or 4 for use on Red Hat Enterprise Linux.
If , this is a finding. Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved ciphers:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
The man page sshd_config(5) contains a list of supported ciphers.
RHEL-06-000244 CCI-001145 medium The operating system must employ FIPS-validated cryptography to protect unclassified information. Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.
Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets industry and government requirements. For government systems, this allows Security Levels 1, 2, 3, or 4 for use on Red Hat Enterprise Linux.
If , this is a finding. Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved ciphers:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
The man page sshd_config(5) contains a list of supported ciphers.
RHEL-06-000245 CCI-001146 medium The operating system must employ NSA-approved cryptography to protect classified information. Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.
Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets industry and government requirements. For government systems, this allows Security Levels 1, 2, 3, or 4 for use on Red Hat Enterprise Linux.
If , this is a finding. Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved ciphers:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
The man page sshd_config(5) contains a list of supported ciphers.
RHEL-06-000246 CCI-000366 low The avahi service must be disabled. Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted. If , this is a finding. The avahi-daemon service can be disabled with the following command:
$ sudo systemctl disable avahi-daemon.service
RHEL-06-000247 CCI-000160 medium The system clock must be synchronized continuously, or at least daily. Enabling some of chronyd or ntpd services ensures that the NTP daemon will be running and that the system will synchronize its time to any servers specified. This is important whether the system is configured to be a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches.

The chronyd and ntpd NTP daemons offer all of the functionality of ntpdate, which is now deprecated. Additional information on this is available at http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate
If , this is a finding. The chronyd service can be enabled with the following command:
$ sudo systemctl enable chronyd.service
Note: The chronyd daemon is enabled by default.

The ntpd service can be enabled with the following command:
$ sudo systemctl enable ntpd.service
Note: The ntpd daemon is not enabled by default. Though as mentioned in the previous sections in certain environments the ntpd daemon might be preferred to be used rather than the chronyd one. Refer to: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html for guidance which NTP daemon to choose depending on the environment used.
RHEL-06-000248 CCI-000160 medium The system clock must be synchronized to an authoritative DoD time source. Synchronizing with an NTP server makes it possible to collate system logs from multiple sources or correlate computer events with real time events. If , this is a finding. Depending on specific functional requirements of a concrete production environment, the Red Hat Enterprise Linux 7 Server system can be configured to utilize the services of the chronyd NTP daemon (the default), or services of the ntpd NTP daemon. Refer to https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html for more detailed comparison of the features of both of the choices, and for further guidance how to choose between the two NTP daemons.
To specify a remote NTP server for time synchronization, perform the following:
  • if the system is configured to use the chronyd as the NTP daemon (the default), edit the file /etc/chrony.conf as follows,
  • if the system is configured to use the ntpd as the NTP daemon, edit the file /etc/ntp.conf as documented below.
Add or correct the following lines, substituting the IP or hostname of a remote NTP server for ntpserver:
server ntpserver
This instructs the NTP software to contact that remote server to obtain time data.
RHEL-06-000249 CCI-000382 medium Mail relaying must be restricted. This ensures postfix accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack. If , this is a finding. Edit the file /etc/postfix/main.cf to ensure that only the following inet_interfaces line appears:
inet_interfaces = localhost
RHEL-06-000252 CCI-001453 medium If the system is using LDAP for authentication or account information, the system must use a TLS connection using FIPS 140-2 approved cryptographic algorithms. The ssl directive specifies whether to use ssl or not. If not specified it will default to no. It should be set to start_tls rather than doing LDAP over SSL. If , this is a finding. Configure LDAP to enforce TLS use. First, edit the file /etc/nslcd.conf, and add or correct the following lines:
ssl start_tls
Then review the LDAP server and ensure TLS has been configured.
RHEL-06-000253 CCI-000776 medium The LDAP client must use a TLS connection using trust certificates signed by the site CA. The tls_cacertdir or tls_cacertfile directives are required when tls_checkpeer is configured (which is the default for openldap versions 2.1 and up). These directives define the path to the trust certificates signed by the site CA. If , this is a finding. Ensure a copy of a trusted CA certificate has been placed in the file /etc/pki/tls/CA/cacert.pem. Configure LDAP to enforce TLS use and to trust certificates signed by that CA. First, edit the file /etc/nslcd.conf, and add or correct either of the following lines:
tls_cacertdir /etc/pki/tls/CA
or
tls_cacertfile /etc/pki/tls/CA/cacert.pem
Then review the LDAP server and ensure TLS has been configured.
RHEL-06-000256 CCI-000366 low The openldap-servers package must not be installed unless required. Unnecessary packages should not be installed to decrease the attack surface of the system. While this software is clearly essential on an LDAP server, it is not necessary on typical desktop or workstation systems. If , this is a finding. The openldap-servers package should be removed if not in use. Is this machine the OpenLDAP server? If not, remove the package.
$ sudo yum erase openldap-servers
The openldap-servers RPM is not installed by default on Red Hat Enterprise Linux 7 machines. It is needed only by the OpenLDAP server, not by the clients which use LDAP for authentication. If the system is not intended for use as an LDAP Server it should be removed.
RHEL-06-000257 CCI-000057 medium The graphical desktop environment must set the idle timeout to no more than 15 minutes. A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME3 can be configured to identify when a user's session has idled and take action to initiate a session lock. If , this is a finding. The idle time-out value for inactivity in the GNOME3 desktop is configured via the idle-delay setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/local.d directory and locked in /etc/dconf/db/local.d/locks directory to prevent user modification.
For example, to configure the system for a 15 minute delay, add the following to /etc/dconf/db/local.d/00-security-settings:
[org/gnome/desktop/session]
idle-delay=900
Once the setting has been added, add a lock to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:
/org/gnome/desktop/session/idle-delay
After the settings have been set, run dconf update.
RHEL-06-000258 CCI-000057 medium The graphical desktop environment must automatically lock after 15 minutes of inactivity and the system must require user to re-authenticate to unlock the environment. A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. Enabling idle activation of the screensaver ensures the screensaver will be activated after the idle delay. Applications requiring continuous, real-time screen display (such as network management products) require the login session does not have administrator rights and the display station is located in a controlled-access area. If , this is a finding. To activate the screensaver in the GNOME3 desktop after a period of inactivity, add or set idle-activation-enabled to true in /etc/dconf/db/local.d/00-security-settings. For example:
[org/gnome/desktop/screensaver]
idle_activation_enabled=true
Once the setting has been added, add a lock to /etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification. For example:
/org/gnome/desktop/screensaver/idle-activation-enabled
After the settings have been set, run dconf update.
RHEL-06-000259 CCI-000057 medium The graphical desktop environment must have automatic lock enabled. A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absense. If , this is a finding. To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set lock-enabled to true and lock-delay to 0 in /etc/dconf/db/local.d/00-security-settings. For example:
[org/gnome/desktop/screensaver]
lock-enabled=true
lock-delay=0
Once the settings have been added, add a lock to /etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification. For example:
/org/gnome/desktop/screensaver/lock-enabled
/org/gnome/desktop/screensaver/lock-delay
After the settings have been set, run dconf update.
RHEL-06-000260 CCI-000060 low The system must display a publicly-viewable pattern during a graphical desktop environment session lock. Setting the screensaver mode to blank-only conceals the contents of the display from passersby. If , this is a finding. To set the screensaver mode in the GNOME3 desktop to a blank screen, add or set picture-uri to '' in /etc/dconf/db/local.d/00-security-settings. For example:
[org/gnome/desktop/screensaver]
picture-uri=''
Once the settings have been added, add a lock to /etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification. For example:
/org/gnome/desktop/screensaver/picture-uri
After the settings have been set, run dconf update.
RHEL-06-000261 CCI-000382 low The Automatic Bug Reporting Tool (abrtd) service must not be running. Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the local machine, as well as sensitive information from within a process's address space or registers. If , this is a finding. The Automatic Bug Reporting Tool (abrtd) daemon collects and reports crash data when an application crash is detected. Using a variety of plugins, abrtd can email crash reports to system administrators, log crash reports to files, or forward crash reports to a centralized issue tracking system such as RHTSupport. The abrtd service can be disabled with the following command:
$ sudo systemctl disable abrtd.service
RHEL-06-000262 CCI-000382 low The atd service must be disabled. The atd service could be used by an unsophisticated insider to carry out activities outside of a normal login session, which could complicate accountability. Furthermore, the need to schedule tasks with at or batch is not common. If , this is a finding. The at and batch commands can be used to schedule tasks that are meant to be executed only once. This allows delayed execution in a manner similar to cron, except that it is not recurring. The daemon atd keeps track of tasks scheduled via at and batch, and executes them at the specified time. The atd service can be disabled with the following command:
$ sudo systemctl disable atd.service
RHEL-06-000263 CCI-001250 low Automated file system mounting tools must not be enabled unless needed. Disabling the automounter permits the administrator to statically control filesystem mounting through /etc/fstab. If , this is a finding. The autofs daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as /misc/cd. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing /etc/fstab rather than relying on the automounter.

The autofs service can be disabled with the following command:
$ sudo systemctl disable autofs.service
RHEL-06-000265 CCI-000382 low The ntpdate service must not be running. The ntpdate service may only be suitable for systems which are rebooted frequently enough that clock drift does not cause problems between reboots. In any event, the functionality of the ntpdate service is now available in the ntpd program and should be considered deprecated. If , this is a finding. The ntpdate service sets the local hardware clock by polling NTP servers when the system boots. It synchronizes to the NTP servers listed in /etc/ntp/step-tickers or /etc/ntp.conf and then sets the local hardware clock to the newly synchronized system time. The ntpdate service can be disabled with the following command:
$ sudo systemctl disable ntpdate.service
RHEL-06-000266 CCI-000382 low The oddjobd service must not be running. The oddjobd service may provide necessary functionality in some environments, and can be disabled if it is not needed. Execution of tasks by privileged programs, on behalf of unprivileged ones, has traditionally been a source of privilege escalation security issues. If , this is a finding. The oddjobd service exists to provide an interface and access control mechanism through which specified privileged tasks can run tasks for unprivileged client applications. Communication with oddjobd through the system message bus. The oddjobd service can be disabled with the following command:
$ sudo systemctl disable oddjobd.service
RHEL-06-000267 CCI-000382 low The qpidd service must not be running. The qpidd service is automatically installed when the "base" package selection is selected during installation. The qpidd service listens for network connections, which increases the attack surface of the system. If the system is not intended to receive AMQP traffic, then the qpidd service is not needed and should be disabled or removed. If , this is a finding. The qpidd service provides high speed, secure, guaranteed delivery services. It is an implementation of the Advanced Message Queuing Protocol. By default the qpidd service will bind to port 5672 and listen for connection attempts. The qpidd service can be disabled with the following command:
$ sudo systemctl disable qpidd.service
RHEL-06-000268 CCI-000382 low The rdisc service must not be running. General-purpose systems typically have their network and routing information configured statically by a system administrator. Workstations or some special-purpose systems often use DHCP (instead of IRDP) to retrieve dynamic network configuration information. If , this is a finding. The rdisc service implements the client side of the ICMP Internet Router Discovery Protocol (IRDP), which allows discovery of routers on the local subnet. If a router is discovered then the local routing table is updated with a corresponding default route. By default this daemon is disabled. The rdisc service can be disabled with the following command:
$ sudo systemctl disable rdisc.service
RHEL-06-000269 CCI-000366 medium Remote file systems must be mounted with the "nodev" option. Legitimate device files should only exist in the /dev directory. NFS mounts should not present device files to users. If , this is a finding. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of any NFS mounts.
RHEL-06-000270 CCI-000366 medium Remote file systems must be mounted with the "nosuid" option. NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables should be installed to their default location on the local filesystem. If , this is a finding. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of any NFS mounts.
RHEL-06-000273 CCI-000366 low The system must use SMB client signing for connecting to samba servers using mount.cifs. Packet signing can prevent man-in-the-middle attacks which modify SMB packets in transit. If , this is a finding. Require packet signing of clients who mount Samba shares using the mount.cifs program (e.g., those who specify shares in /etc/fstab). To do so, ensure signing options (either sec=krb5i or sec=ntlmv2i) are used.

See the mount.cifs(8) man page for more information. A Samba client should only communicate with servers who can support SMB packet signing.
RHEL-06-000274 CCI-000200 medium The system must prohibit the reuse of passwords within twenty-four iterations. Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user. If , this is a finding. Do not allow users to reuse recent passwords. This can be accomplished by using the remember option for the pam_unix or pam_pwhistory PAM modules. In the file /etc/pam.d/system-auth, append remember= to the line which refers to the pam_unix.so or pam_pwhistory.somodule, as shown below:
  • for the pam_unix.so case:
    password sufficient pam_unix.so existing_options remember=
  • for the pam_pwhistory.so case:
    password requisite pam_pwhistory.so existing_options remember=
The DoD STIG requirement is 5 passwords.
RHEL-06-000275 CCI-001019 low The operating system must employ cryptographic mechanisms to protect information in storage. The risk of a system's physical compromise, particularly mobile systems such as laptops, places its data at risk of compromise. Encrypting this data mitigates the risk of its loss if the system is lost. If , this is a finding. Red Hat Enterprise Linux 7 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time.

For manual installations, select the Encrypt checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots.

For automated/unattended installations, it is possible to use Kickstart by adding the --encrypted and --passphrase= options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:
part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE
Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the --passphrase= option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation.

Detailed information on encrypting partitions using LUKS can be found on the Red Hat Documentation web site:
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html
RHEL-06-000276 CCI-001199 low The operating system must protect the confidentiality and integrity of data at rest. The risk of a system's physical compromise, particularly mobile systems such as laptops, places its data at risk of compromise. Encrypting this data mitigates the risk of its loss if the system is lost. If , this is a finding. Red Hat Enterprise Linux 7 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time.

For manual installations, select the Encrypt checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots.

For automated/unattended installations, it is possible to use Kickstart by adding the --encrypted and --passphrase= options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:
part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE
Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the --passphrase= option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation.

Detailed information on encrypting partitions using LUKS can be found on the Red Hat Documentation web site:
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html
RHEL-06-000277 CCI-001200 low The operating system must employ cryptographic mechanisms to prevent unauthorized disclosure of data at rest unless otherwise protected by alternative physical measures. The risk of a system's physical compromise, particularly mobile systems such as laptops, places its data at risk of compromise. Encrypting this data mitigates the risk of its loss if the system is lost. If , this is a finding. Red Hat Enterprise Linux 7 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time.

For manual installations, select the Encrypt checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots.

For automated/unattended installations, it is possible to use Kickstart by adding the --encrypted and --passphrase= options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:
part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE
Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the --passphrase= option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation.

Detailed information on encrypting partitions using LUKS can be found on the Red Hat Documentation web site:
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html
RHEL-06-000282 CCI-000366 medium There must be no world-writable files on the system. Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files. If , this is a finding. It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account.
RHEL-06-000284 CCI-001668 high The system must use and update a DoD-approved virus scan program. Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems. If , this is a finding. Install virus scanning software, which uses signatures to search for the presence of viruses on the filesystem. Ensure virus definition files are no older than 7 days, or their last release. Configure the virus scanning software to perform scans dynamically on all accessed files. If this is not possible, configure the system to scan all altered files on the system on a daily basis. If the system processes inbound SMTP mail, configure the virus scanner to scan all received mail.
RHEL-06-000285 CCI-001263 medium The system must have a host-based intrusion detection tool installed. Host-based intrusion detection tools provide a system-level defense when an intruder gains access to a system or network. If , this is a finding. The base Red Hat platform already includes a sophisticated auditing system that can detect intruder activity, as well as SELinux, which provides host-based intrusion prevention capabilities by confining privileged programs and user sessions which may become compromised.
RHEL-06-000286 CCI-000366 high The x86 Ctrl-Alt-Delete key sequence must be disabled. A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. If , this is a finding. By default, SystemD will reboot the system if the Ctrl-Alt-Del key sequence is pressed.
To configure the system to ignore the Ctrl-Alt-Del key sequence from the command line instead of rebooting the system, do either of the following:
ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target
or
systemctl mask ctrl-alt-del.target

Do not simply delete the /usr/lib/systemd/system/ctrl-alt-del.service file, as this file may be restored during future system updates.
RHEL-06-000287 CCI-000366 low The postfix service must be enabled for mail delivery. Local mail delivery is essential to some system maintenance and notification tasks. If , this is a finding. The Postfix mail transfer agent is used for local mail delivery within the system. The default configuration only listens for connections to the default SMTP port (port 25) on the loopback interface (127.0.0.1). It is recommended to leave this service enabled for local mail delivery. The postfix service can be enabled with the following command:
$ sudo systemctl enable postfix.service
RHEL-06-000288 CCI-000366 medium The sendmail package must be removed. The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead. If , this is a finding. Sendmail is not the default mail transfer agent and is not installed by default. The sendmail package can be removed with the following command:
$ sudo yum erase sendmail
RHEL-06-000289 CCI-000382 low The netconsole service must be disabled unless required. The netconsole service is not necessary unless there is a need to debug kernel panics, which is not common. If , this is a finding. The netconsole service is responsible for loading the netconsole kernel module, which logs kernel printk messages over UDP to a syslog server. This allows debugging of problems where disk logging fails and serial consoles are impractical. The netconsole service can be disabled with the following command:
$ sudo systemctl disable netconsole.service
RHEL-06-000290 CCI-001436 medium X Windows must not be enabled unless required. Services that are not required for system and application processes must not be active to decrease the attack surface of the system. X windows has a long history of security vulnerabilities and should not be used unless approved and documented. If , this is a finding. Systems that do not require a graphical user interface should only boot by default into multi-user.target mode. This prevents accidental booting of the system into a graphical.target mode. Setting the system's default target to multi-user.target will prevent automatic startup of the X server. To do so, run:
$ systemctl set-default multi-user.target
You should see the following output:
rm '/etc/systemd/system/default.target'
ln -s '/usr/lib/systemd/system/multi-user.target' '/etc/systemd/system/default.target'
RHEL-06-000291 CCI-000366 low The xorg-x11-server-common (X Windows) package must not be installed, unless required. Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security vulnerabilities and should not be installed unless approved and documented. If , this is a finding. By removing the xorg-x11-server-common package, the system no longer has X Windows installed. If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a graphical.target mode. To do so, run the following command:
$ sudo yum groupremove "X Window System"
$ sudo yum remove xorg-x11-server-common
RHEL-06-000292 CCI-000366 medium The DHCP client must be disabled if not needed. DHCP relies on trusting the local network. If the local network is not trusted, then it should not be used. However, the automatic configuration provided by DHCP is commonly used and the alternative, manual configuration, presents an unacceptable burden in many circumstances. If , this is a finding. For each interface on the system (e.g. eth0), edit /etc/sysconfig/network-scripts/ifcfg-interface and make the following changes:
  • Correct the BOOTPROTO line to read:
    BOOTPROTO=none
  • Add or correct the following lines, substituting the appropriate values based on your site's addressing scheme:
    NETMASK=255.255.255.0
    IPADDR=192.168.1.2
    GATEWAY=192.168.1.1
RHEL-06-000294 CCI-000366 low All GIDs referenced in /etc/passwd must be defined in /etc/group If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group with the Gruop Identifier (GID) is subsequently created, the user may have unintended rights to any files associated with the group. If , this is a finding. Add a group to the system for each GID referenced without a corresponding group.
RHEL-06-000296 CCI-000804 low All accounts on the system must have unique user or account names Unique usernames allow for accountability on the system. If , this is a finding. Change usernames, or delete accounts, so each has a unique name.
RHEL-06-000300 CCI-000224 low All files and directories must have a valid owner. Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. If , this is a finding. If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user.
RHEL-06-000301 CCI-000224 low All files must be owned by a group. Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. If , this is a finding. If any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group.
RHEL-06-000302 CCI-000374 medium A file integrity tool must be used at least weekly to check for unauthorized file changes, particularly the addition of unauthorized system libraries or binaries, or for unauthorized modification to authorized system libraries or binaries. By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. If , this is a finding. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
RHEL-06-000303 CCI-000416 medium The operating system must employ automated mechanisms, per organization defined frequency, to detect the addition of unauthorized components/devices into the operating system. By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. If , this is a finding. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
RHEL-06-000304 CCI-001069 medium The operating system must employ automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization defined frequency. By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. If , this is a finding. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
RHEL-06-000305 CCI-001263 medium The operating system must provide a near real-time alert when any of the organization defined list of compromise or potential compromise indicators occurs. By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. If , this is a finding. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
RHEL-06-000306 CCI-001297 medium The operating system must detect unauthorized changes to software and information. By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. If , this is a finding. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
RHEL-06-000307 CCI-001589 medium The operating system must ensure unauthorized, security-relevant configuration changes detected are tracked. By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. If , this is a finding. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
RHEL-06-000308 CCI-000366 low Process core dumps must be disabled unless needed. A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems. If , this is a finding. To disable core dumps for all users, add the following line to /etc/security/limits.conf:
*     hard   core    0
RHEL-06-000309 CCI-000764 high The NFS server must not have the insecure file locking option enabled. Allowing insecure file locking could allow for sensitive data to be viewed or edited by an unauthorized user. If , this is a finding. By default the NFS server requires secure file-lock requests, which require credentials from the client in order to lock a file. Most NFS clients send credentials with file lock requests, however, there are a few clients that do not send credentials when requesting a file-lock, allowing the client to only be able to lock world-readable files. To get around this, the insecure_locks option can be used so these clients can access the desired export. This poses a security risk by potentially allowing the client access to data for which it does not have authorization. Remove any instances of the insecure_locks option from the file /etc/exports.
RHEL-06-000311 CCI-000143 medium The audit system must provide a warning when allocated audit record storage volume reaches a documented percentage of maximum audit record storage capacity. Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption. If , this is a finding. The auditd service can be configured to take an action when disk space starts to run low. Edit the file /etc/audit/auditd.conf. Modify the following line, substituting ACTION appropriately:
space_left_action = ACTION
Possible values for ACTION are described in the auditd.conf man page. These include:
  • ignore
  • syslog
  • email
  • exec
  • suspend
  • single
  • halt
Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. Acceptable values also include suspend, single, and halt.
RHEL-06-000313 CCI-000139 medium The audit system must identify staff members to receive notifications of audit log storage volume capacity issues. Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action. If , this is a finding. The auditd service can be configured to send email to a designated account in certain situations. Add or correct the following line in /etc/audit/auditd.conf to ensure that administrators are notified via email for those situations:
action_mail_acct = 
RHEL-06-000315 CCI-000085 medium The Bluetooth kernel module must be disabled. If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation. If , this is a finding. The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate /etc/modprobe.d configuration file to prevent the loading of the Bluetooth module:
install bluetooth /bin/true
RHEL-06-000317 CCI-001250 medium The system must have USB Mass Storage disabled unless needed. USB storage devices such as thumb drives can be used to introduce malicious software. If , this is a finding. To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the usb-storage kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:
install usb-storage /bin/true
This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.
RHEL-06-000319 CCI-000054 low The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements. Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions. If , this is a finding. Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in /etc/security/limits.conf:
* hard maxlogins 
RHEL-06-000324 CCI-000050 medium A login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts. Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. If , this is a finding. To enable displaying a login warning banner in the GNOME Display Manager's login screen, the banner-message-enable setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/gdm.d directory and locked in /etc/dconf/db/gdm.d/locks directory to prevent user modification. After the settings have been set, run dconf update. To display a banner, this setting must be enabled, and the user must be prevented from making changes. The banner text must also be set.
RHEL-06-000326 CCI-NaN medium The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts. An appropriate warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. If , this is a finding. To set the text shown by the GNOME3 Display Manager in the login screen, the banner-message-text setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/gdm.d directory and locked in /etc/dconf/db/gdm.d/locks directory to prevent user modification. After the settings have been set, run dconf update. When entering a warning banner that spans several lines, remember to begin and end the string with ' and use \n for new lines.
RHEL-06-000331 CCI-000085 medium The Bluetooth service must be disabled. Disabling the bluetooth service prevents the system from attempting connections to Bluetooth devices, which entails some security risk. Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range. If , this is a finding. The bluetooth service can be disabled with the following command:
$ sudo systemctl disable bluetooth.service
$ sudo service bluetooth stop
RHEL-06-000334 CCI-000017 low Accounts must be locked upon 35 days of inactivity. Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. If , this is a finding. To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following lines in /etc/default/useradd, substituting NUM_DAYS appropriately:
INACTIVE=
A value of 35 is recommended. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the useradd man page for more information. Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period of inactivity for users in the particular environment. Setting the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users.
RHEL-06-000335 CCI-000795 low The operating system must manage information system identifiers for users and devices by disabling the user identifier after an organization defined time period of inactivity. Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. If , this is a finding. To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following lines in /etc/default/useradd, substituting NUM_DAYS appropriately:
INACTIVE=
A value of 35 is recommended. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the useradd man page for more information. Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period of inactivity for users in the particular environment. Setting the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users.
RHEL-06-000336 CCI-000366 low The sticky bit must be set on all public directories. Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure.

The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as /tmp), and for directories requiring global read/write access.
If , this is a finding. When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes.
To set the sticky bit on a world-writable directory DIR, run the following command:
$ sudo chmod +t DIR
RHEL-06-000337 CCI-000366 low All public directories must be owned by a system account. Allowing a user account to own a world-writable directory is undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users. If , this is a finding. All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group.
RHEL-06-000338 CCI-000366 high The TFTP daemon must operate in "secure mode" which provides access only to a single directory on the host file system. Using the -s option causes the TFTP service to only serve files from the given directory. Serving files from an intentionally-specified directory reduces the risk of sharing files which should remain private. If , this is a finding. If running the tftp service is necessary, it should be configured to change its root directory at startup. To do so, ensure /etc/xinetd.d/tftp includes -s as a command line argument, as shown in the following example (which is also the default):
server_args = -s /var/lib/tftpboot
RHEL-06-000339 CCI-000130 low The FTP daemon must be configured for logging or verbose mode. To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to the FTP server are logged using the verbose vsftpd log format. The default vsftpd log file is /var/log/vsftpd.log. If , this is a finding. Add or correct the following configuration options within the vsftpd configuration file, located at /etc/vsftpd/vsftpd.conf:
xferlog_enable=YES
xferlog_std_format=NO
log_ftp_protocol=YES
RHEL-06-000340 CCI-000366 medium The snmpd service must use only SNMP protocol version 3 or newer. Earlier versions of SNMP are considered insecure, as they potentially allow unauthorized access to detailed system management information. If , this is a finding. Edit /etc/snmp/snmpd.conf, removing any references to rocommunity, rwcommunity, or com2sec. Upon doing that, restart the SNMP service:
$ sudo service snmpd restart
RHEL-06-000341 CCI-000366 high The snmpd service must not use a default password. Whether active or not, default simple network management protocol (SNMP) community strings must be changed to maintain security. If the service is running with the default authenticators, then anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system and network(s). If , this is a finding. Edit /etc/snmp/snmpd.conf, remove or change the default community strings of public and private. Once the default community strings have been changed, restart the SNMP service:
$ sudo service snmpd restart
RHEL-06-000342 CCI-000366 low The system default umask for the bash shell must be 077. The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. If , this is a finding. To ensure the default umask for users of the Bash shell is set properly, add or correct the umask setting in /etc/bashrc to read as follows:
umask 
RHEL-06-000343 CCI-000366 low The system default umask for the csh shell must be 077. The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. If , this is a finding. To ensure the default umask for users of the C shell is set properly, add or correct the umask setting in /etc/csh.cshrc to read as follows:
umask 
RHEL-06-000344 CCI-000366 low The system default umask in /etc/profile must be 077. The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. If , this is a finding. To ensure the default umask controlled by /etc/profile is set properly, add or correct the umask setting in /etc/profile to read as follows:
umask 
RHEL-06-000345 CCI-000366 low The system default umask in /etc/login.defs must be 077. The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and written to by unauthorized users. If , this is a finding. To ensure the default umask controlled by /etc/login.defs is set properly, add or correct the UMASK setting in /etc/login.defs to read as follows:
UMASK 
RHEL-06-000346 CCI-000366 low The system default umask for daemons must be 027 or 022. The umask influences the permissions assigned to files created by a process at run time. An unnecessarily permissive umask could result in files being created with insecure permissions. If , this is a finding. The file /etc/init.d/functions includes initialization parameters for most or all daemons started at boot time. The default umask of 022 prevents creation of group- or world-writable files. To set the default umask for daemons, edit the following line, inserting 022 or 027 for UMASK appropriately:
umask 
Setting the umask to too restrictive a setting can cause serious errors at runtime. Many daemons on the system already individually restrict themselves to a umask of 077 in their own init scripts.
RHEL-06-000347 CCI-000196 medium There must be no .netrc files on the system. Unencrypted passwords for remote FTP servers may be stored in .netrc files. DoD policy requires passwords be encrypted in storage and not used in access scripts. If , this is a finding. The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any .netrc files should be removed.
RHEL-06-000348 CCI-000048 medium The FTPS/FTP service on the system must be configured with the Department of Defense (DoD) login banner. This setting will cause the system greeting banner to be used for FTP connections as well. If , this is a finding. Edit the vsftpd configuration file, which resides at /etc/vsftpd/vsftpd.conf by default. Add or correct the following configuration options:
banner_file=/etc/issue
RHEL-06-000349 CCI-000765 medium The system must be configured to require the use of a CAC, PIV compliant hardware token, or Alternate Logon Token (ALT) for authentication. Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials. If , this is a finding. To enable smart card authentication, consult the documentation at:
  • https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards
For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at:
  • https://access.redhat.com/solutions/82273
RHEL-06-000357 CCI-001452 medium The system must disable accounts after excessive login failures within a 15-minute interval. Locking out user accounts after a number of incorrect attempts within a specific period of time prevents direct password guessing attacks. If , this is a finding. Utilizing pam_faillock.so, the fail_interval directive configures the system to lock out accounts after a number of incorrect login attempts. Modify the content of both /etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:

  • add the following line immediately before the pam_unix.so statement in the AUTH section:
    auth required pam_faillock.so preauth silent deny= unlock_time= fail_interval=
  • add the following line immediately after the pam_unix.so statement in the AUTH section:
    auth [default=die] pam_faillock.so authfail deny= unlock_time= fail_interval=
  • add the following line immediately before the pam_unix.so statement in the ACCOUNT section:
    account required pam_faillock.so
RHEL-06-000372 CCI-000053 medium The operating system, upon successful logon/access, must display to the user the number of unsuccessful logon/access attempts since the last successful logon/access. Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators. If , this is a finding. To configure the system to notify users of last logon/access using pam_lastlog, add or correct the pam_lastlog settings in /etc/pam.d/postlogin to read as follows:
session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session     [default=1]   pam_lastlog.so nowtmp showfailed
session     optional      pam_lastlog.so silent noupdate showfailed
RHEL-06-000373 CCI-000056 medium The operating system must retain the session lock until the user reestablishes access using established identification and authentication procedures. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000374 CCI-000099 medium The operating system must employ automated mechanisms to enable authorized users to make information sharing decisions based on access authorizations of sharing partners and access restrictions on information to be shared. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000375 CCI-000131 medium The operating system must produce audit records containing sufficient information to establish when (date and time) the events occurred. The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000376 CCI-000132 medium The operating system must produce audit records containing sufficient information to establish where the events occurred. The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000377 CCI-000133 medium The operating system must produce audit records containing sufficient information to establish the sources of the events. The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000378 CCI-000134 medium The operating system must produce audit records containing sufficient information to establish the outcome (success or failure) of the events. The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000379 CCI-000135 medium The operating system must include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject. The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000380 CCI-000154 medium Operating system must support the capability to centralize the review and analysis of audit records from multiple components within the system. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000382 CCI-000159 medium The operating system must use internal system clocks to generate time stamps for audit records. The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000383 CCI-000163 medium Audit log files must have mode 0640 or less permissive. If users can write to audit logs, audit trails can be modified or destroyed. If , this is a finding. If log_group in /etc/audit/auditd.conf is set to a group other than the root group account, change the mode of the audit log files with the following command:
$ sudo chmod 0640 audit_file

Otherwise, change the mode of the audit log files with the following command:
$ sudo chmod 0600 audit_file
RHEL-06-000384 CCI-000162 medium Audit log files must be owned by root. Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. If , this is a finding. To properly set the owner of /var/log, run the command:
$ sudo chown root /var/log
RHEL-06-000387 CCI-000171 medium The operating system must allow designated organizational personnel to select which auditable events are to be audited by the operating system. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000388 CCI-000174 medium The operating system must support the capability to compile audit records from multiple components within the system into a system-wide (logical or physical) audit trail that is time-correlated to within organization defined level of tolerance. The Red Hat Enterprise Linux audit system meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000389 CCI-000185 medium The operating system, for PKI-based authentication must validate certificates by constructing a certification path with status information to an accepted trust anchor. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000390 CCI-000186 medium The operating system, for PKI-based authentication must enforce authorized access to the corresponding private key. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000392 CCI-000206 medium The operating system must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000396 CCI-000223 medium The operating system must bind security attributes to information to facilitate information flow policy enforcement. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000397 CCI-000226 medium The operating system must provide the capability for a privileged administrator to configure organization defined security policy filters to support different security policies. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000398 CCI-000345 medium The operating system must enforce logical access restrictions associated with changes to the information system. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000399 CCI-000346 medium The operating system must employ automated mechanisms to enforce access restrictions. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000403 CCI-000386 medium The operating system must employ automated mechanisms to prevent program execution in accordance with the organization defined specifications. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000411 CCI-000802 medium The operating system must dynamically manage identifiers, attributes, and associated access authorizations. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000412 CCI-000872 medium The operating system must employ automated mechanisms to restrict the use of maintenance tools to authorized personnel only. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000414 CCI-001082 medium The operating system must separate user functionality (including user interface services) from operating system management functionality. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000415 CCI-001083 medium The operating system must prevent the presentation of information system management-related functionality at an interface for general (i.e., non-privileged) users. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000416 CCI-001084 medium The operating system must isolate security functions from nonsecurity functions. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000417 CCI-001086 medium The operating system must isolate security functions enforcing access and information flow control from both non-security functions and from other security functions. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000418 CCI-001087 medium The operating system must implement an information system isolation boundary to minimize the number of non-security functions included within the boundary containing security functions. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000419 CCI-001089 medium The operating system must implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000420 CCI-001090 medium The operating system must prevent unauthorized and unintended information transfer via shared system resources. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000421 CCI-001091 medium The operating system must not share resources used to interface with systems operating at different security levels. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000423 CCI-001096 medium The operating system must limit the use of resources by priority. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000424 CCI-001111 medium The operating system must prevent remote devices that have established a non-remote connection with the system from communicating outside of the communication path with resources in external networks. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000430 CCI-001127 medium The operating system must protect the integrity of transmitted information. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000431 CCI-001128 medium The operating system must employ cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000432 CCI-001129 medium The operating system must maintain the integrity of information during aggregation, packaging, and transformation in preparation for transmission. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000445 CCI-001158 medium The operating system must validate the integrity of security attributes exchanged between systems. RHEL7 does not support this requirement. If , this is a finding. This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.
RHEL-06-000451 CCI-001209 medium The operating system must protect the integrity of information during the processes of data aggregation, packaging, and transformation in preparation for transmission. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000454 CCI-001214 medium The operating system must employ organization defined information system components with no writeable storage that are persistent across component restart or power on/off. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000455 CCI-001232 medium The operating system must install software updates automatically. This is a manual inquiry about update procedure. If , this is a finding. Procedures to promptly apply software updates must be established and executed. The Red Hat operating system provides support for automating such a process, by running the yum program through a cron job or by managing the system and its packages through the Red Hat Network or a Satellite Server.
RHEL-06-000456 CCI-001237 medium The operating system must support automated patch management tools to facilitate flaw remediation to organization defined information system components. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000457 CCI-001248 medium The operating system must prevent non-privileged users from circumventing malicious code protection capabilities. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000458 CCI-001265 medium The operating system must prevent non-privileged users from circumventing intrusion detection and prevention capabilities. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000459 CCI-001269 medium The operating system must protect information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000460 CCI-001291 medium The operating system must verify the correct operation of security functions in accordance with organization defined conditions and in accordance with organization defined frequency (if periodic verification). Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000461 CCI-001294 medium The operating system must provide notification of failed automated security tests. RHEL7 does not support this requirement. If , this is a finding. This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.
RHEL-06-000463 CCI-001295 medium The operating system must provide automated support for the management of distributed security testing. RHEL7 does not support this requirement. If , this is a finding. This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.
RHEL-06-000464 CCI-001310 medium The operating system must check the validity of information inputs. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000465 CCI-001328 medium The operating system must support the requirement that organizations, if an information system component failure is detected must activate an organization defined alarm and/or automatically shuts down the operating system. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000466 CCI-001338 medium The operating system must associate the identity of the information producer with the information. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000473 CCI-001362 medium The operating system must enforce an organization defined Discretionary Access Control (DAC) policy that must allow users to specify and control sharing by named individuals or groups of individuals, or by both. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000474 CCI-001368 medium The operating system must enforce approved authorizations for controlling the flow of information within the system in accordance with applicable policy. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000485 CCI-001399 medium The operating system must support and maintain the binding of organization defined security attributes to information in storage. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000486 CCI-001400 medium The operating system must support and maintain the binding of organization defined security attributes to information in process. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000488 CCI-001424 medium The operating system must dynamically reconfigure security attributes in accordance with an identified security policy as information is created and combined. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000489 CCI-001425 medium The operating system must only allow authorized entities to change security attributes. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000490 CCI-001426 medium The operating system must maintain the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000491 CCI-001427 medium The operating system must only allow authorized users to associate security attributes with information. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000492 CCI-001428 medium The operating system must display security attributes in human-readable form on each object output from the system to system output devices to identify an organization-identified set of special dissemination, handling, or distribution instructions using organization-identified human readable, standard naming conventions. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000493 CCI-001694 medium The operating system must enforce a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000494 CCI-001500 medium The operating system must automatically implement organization defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately. RHEL7 does not support this requirement. If , this is a finding. This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.
RHEL-06-000497 CCI-001693 medium The operating system must enforce a Discretionary Access Control (DAC) policy that limits propagation of access rights. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000500 CCI-001665 medium The operating system must preserve organization defined system state information in the event of a system failure. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000501 CCI-001670 medium The operating system must take organization defined list of least disruptive actions to terminate suspicious events. Red Hat Enterprise Linux meets this requirement through design and implementation. If , this is a finding. This requirement is a permanent not a finding. No fix is required.
RHEL-06-000503 CCI-000086 medium The system must have USB Mass Storage disabled unless needed. USB storage devices such as thumb drives can be used to introduce malicious software. If , this is a finding. To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the usb-storage kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:
install usb-storage /bin/true
This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.
RHEL-06-000509 CCI-000136 low The system must forward audit records to the syslog service. The auditd service does not include the ability to send audit records to a centralized server for management directly. It does, however, include a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server If , this is a finding. To configure the auditd service to use the syslog plug-in of the audispd audit event multiplexor, set the active line in /etc/audisp/plugins.d/syslog.conf to yes. Restart the auditd service:
$ sudo service auditd restart
RHEL-06-000512 CCI-000144 medium The audit system must alert designated staff members when audit storage volume is full. RHEL7 does not support this requirement. If , this is a finding. This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.
RHEL-06-000513 CCI-000144 medium The audit system must alert designated staff members when audit storage volume is generating disk errors. RHEL7 does not support this requirement. If , this is a finding. This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.
RHEL-06-000518 CCI-000366 low The system package management tool must verify permissions on all files and directories associated with packages. Permissions on system binaries and configuration files that are too generous could allow an unauthorized user to gain privileges that they should not have. The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated. If , this is a finding. Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default. The RPM package management system can check file access permissions of installed software packages, including many that are important to system security. Verify that the file permissions, ownership, and gruop membership of system files and commands match vendor values. Check the file permissions, ownership, and group membership with the following command:
$ sudo rpm -Va | grep '^.M'
Output indicates files that do not match vendor defaults. After locating a file with incorrect permissions, run the following command to determine which package owns it:
$ rpm -qf FILENAME
Next, run the following command to reset its permissions to the correct values:
$ sudo rpm --setperms PACKAGENAME
RHEL-06-000519 CCI-000366 low The system package management tool must verify contents of all files associated with packages. The hashes of important files like system executables should match the information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system. If , this is a finding. Without cryptographic integrity protections, system executables and files can be altered by unauthorized users without detection. The RPM package management system can check the hashes of installed software packages, including many that are important to system security. To verify that the cryptographic hash of system files and commands match vendor values, run the following command to list which files on the system have hashes that differ from what is expected by the RPM database:
$ rpm -Va | grep '^..5'
A "c" in the second column indicates that a file is a configuration file, which may appropriately be expected to change. If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file:
$ rpm -qf FILENAME
The package can be reinstalled from a yum repository using the command:
$ sudo yum reinstall PACKAGENAME
Alternatively, the package can be reinstalled from trusted media using the command:
$ sudo rpm -Uvh PACKAGENAME
RHEL-06-000525 CCI-000169 low Auditing must be enabled at boot by setting a kernel parameter. Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot. If , this is a finding. To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument audit=1 to the default GRUB 2 command line for the Linux operating system in /etc/default/grub, in the manner below:
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1"
RHEL-06-000526 CCI-000366 low Automated file system mounting tools must not be enabled unless needed. Disabling the automounter permits the administrator to statically control filesystem mounting through /etc/fstab. If , this is a finding. The autofs daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as /misc/cd. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing /etc/fstab rather than relying on the automounter.

The autofs service can be disabled with the following command:
$ sudo systemctl disable autofs.service
SRG-OS-000006-NA CCI-000021 medium The operating system must enforce dual authorization, based on organizational policies and procedures for organization defined privileged commands. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000008-NA CCI-000024 medium The operating system must prevent access to organization defined security-relevant information except during secure, non-operable system states. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000009-NA CCI-000025 medium The operating system must enforce information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000010-NA CCI-000026 medium The operating system must enforce information flow control using protected processing domains (e.g., domain type-enforcement) as a basis for flow control decisions. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000011-NA CCI-000027 medium The operating system must enforce dynamic information flow control based on policy that must allow or disallow information flows based upon changing conditions or operational considerations. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000012-NA CCI-000028 medium The operating system must prevent encrypted data from bypassing content checking mechanisms. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000013-NA CCI-000029 medium The operating system must enforce organization defined limitations on the embedding of data types within other data types. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000014-NA CCI-000030 medium The operating system must enforce information flow control on metadata. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000016-NA CCI-000032 medium The operating system must enforce information flow control using organization defined security policy filters as a basis for flow control decisions. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000018-NA CCI-000035 medium The operating system must provide the capability for a privileged administrator to configure the organization defined security policy filters to support different security policies. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000019-NA CCI-000037 medium The operating system must implement separation of duties through assigned information system access authorizations. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000060-NA CCI-000165 medium The operating system must produce audit records on hardware-enforced, write-once media. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000061-NA CCI-000166 medium The operating system must protect against an individual falsely denying having performed a particular action. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000068-NA CCI-000187 medium The operating system, for PKI-based authentication must map the authenticated identity to the user account. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000074-NA CCI-000197 medium The operating system must enforce password encryption for transmission. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000081-NA CCI-000218 medium The operating system, when transferring information between different security domains, must identify information flows by data type specification and usage. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000082-NA CCI-000219 medium The operating system, when transferring information between different security domains, must decompose information into policy-relevant subcomponents for submission to policy enforcement mechanisms. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000083-NA CCI-000221 medium The operating system must enforce security policies regarding information on interconnected systems. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000091-NA CCI-000354 medium The operating system must enforce a two-person rule for changes to organization defined information system components and system-level information. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000092-NA CCI-000371 medium The operating system must employ automated mechanisms to centrally apply configuration settings. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000093-NA CCI-000372 medium The operating system must employ automated mechanisms to centrally verify configuration settings. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000101-NA CCI-000539 medium The operating system must conduct backups of operating system documentation including security-related documentation per organization defined frequency to conduct backups that is consistent with recovery time and recovery point objectives. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000102-NA CCI-000553 medium The operating system must implement transaction recovery for transaction-based systems. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000107-NA CCI-000767 medium The operating system must use multifactor authentication for local access to privileged accounts. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000108-NA CCI-000768 medium The operating system must use multifactor authentication for local access to non-privileged accounts. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000110-NA CCI-000771 medium The operating system must use multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the information system being accessed. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000111-NA CCI-000772 medium The operating system must use multifactor authentication for network access to non-privileged accounts where one of the factors is provided by a device separate from the operating system being accessed. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000115-NA CCI-000779 medium The operating system must authenticate devices before establishing remote network connections using bidirectional cryptographically based authentication between devices. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000116-NA CCI-000780 medium The operating system must authenticate devices before establishing wireless network connections using bidirectional cryptographically based authentication between devices. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000117-NA CCI-000781 medium The operating system must authenticate devices before establishing network connections using bidirectional cryptographically based authentication between devices. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000122-NA CCI-000831 medium The operating system must implement a configurable capability to automatically disable the operating system if any of the organization defined lists of security violations are detected. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000125-NA CCI-000877 medium The operating system must employ strong identification and authentication techniques in the establishment of nonlocal maintenance and diagnostic sessions. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000128-NA CCI-000884 medium The operating system must protect nonlocal maintenance sessions through the use of a strong authenticator tightly bound to the user. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000130-NA CCI-001009 medium The operating system must use cryptographic mechanisms to protect and restrict access to information on portable digital media. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000140-NA CCI-001092 medium The operating system must protect against or must limit the effects of the organization defined or referenced types of Denial of Service attacks. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000141-NA CCI-001094 medium The operating system must restrict the ability of users to launch Denial of Service attacks against other information systems or networks. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000149-NA CCI-001112 medium The operating system must route organization defined internal communications traffic to organization defined external networks through authenticated proxy servers within the managed interfaces of boundary protection devices. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000150 CCI-001115 medium The operating system, at managed interfaces, must deny network traffic and must audit internal users (or malicious code) posing a threat to external information systems. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000153-NA CCI-001123 medium The operating system must route all networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000154-NA CCI-001124 medium The operating system must prevent discovery of specific system components (or devices) composing a managed interface. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000155-NA CCI-001125 medium The operating system must employ automated mechanisms to enforce strict adherence to protocol format. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000156-NA CCI-001126 medium The operating system must fail securely in the event of an operational failure of a boundary protection device. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000161-NA CCI-001131 medium The operating system must employ cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000162-NA CCI-001132 medium The operating system must maintain the confidentiality of information during aggregation, packaging, and transformation in preparation for transmission. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000164-NA CCI-001135 medium The operating system must establish a trusted communications path between the user and organization defined security functions within the operating system. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000165-NA CCI-001140 medium The operating system must produce, control, and distribute symmetric cryptographic keys using NIST-approved or NSA-approved key management technology and processes. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000166-NA CCI-001141 medium The operating system must produce, control, and distribute symmetric and asymmetric cryptographic keys using NSA-approved key management technology and processes. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000167-NA CCI-001142 medium The operating system must produce, control, and distribute asymmetric cryptographic keys using approved PKI Class 3 certificates or prepositioned keying material. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000168-NA CCI-001143 medium The operating system must produce, control, and distribute asymmetric cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000172-NA CCI-001147 medium The operating system must employ FIPS-validated cryptography to protect information when it must be separated from individuals who have the necessary clearances, yet lack the necessary access approvals. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000173-NA CCI-001148 medium The operating system must employ FIPS-validate or NSA-approved cryptography to implement digital signatures. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000174-NA CCI-001149 medium The operating system must protect the integrity and availability of publicly available information and applications. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000175-NA CCI-001150 medium The operating system must prohibit remote activation of collaborative computing devices, excluding the organization defined exceptions where remote activation is to be allowed. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000177-NA CCI-001157 medium The operating system must associate security attributes with information exchanged between information systems. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000179-NA CCI-001159 medium The operating system must issue or obtain public key certificates under an appropriate certificate policy from an approved service provider. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000180-NA CCI-001166 medium The operating system must implement detection and inspection mechanisms to identify unauthorized mobile code. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000181-NA CCI-001695 medium The operating system must prevent the execution of prohibited mobile code. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000182-NA CCI-001169 medium The operating system must prevent the download of prohibited mobile code. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000183-NA CCI-001170 medium The operating system must prevent the automatic execution of mobile code in organization defined software applications and must require organization defined actions prior to executing the code. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000187-NA CCI-001210 medium The operating system at organization defined information system components must load and execute the operating environment from hardware-enforced, read-only media. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000188-NA CCI-001211 medium The operating system at organization defined information system components must load and execute organization defined applications from hardware-enforced, read-only media. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000193-NA CCI-001239 medium The operating system must have malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000204-NA CCI-001311 medium The operating system must identify potentially security-relevant error conditions. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000205-NA CCI-001312 medium The operating system must generate error messages providing information necessary for corrective actions without revealing organization defined sensitive or potentially harmful information in error logs and administrative messages that could be exploited. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000209-NA CCI-001339 medium The operating system must validate the binding of the information producer's identity to the information. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000210-NA CCI-001340 medium The operating system must maintain reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000211-NA CCI-001341 medium The operating system must validate the binding of the reviewer's identity to the information at the transfer/release point prior to release/transfer from one security domain to another security domain. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000214-NA CCI-001274 medium The operating system must employ automated mechanisms to alert security personnel of any organization defined inappropriate or unusual activities with security implications. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000216-NA CCI-001350 medium The operating system must use cryptographic mechanisms to protect the integrity of audit information. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000217-NA CCI-001352 medium The operating system must protect the audit records resulting from nonlocal accesses to privileged accounts and the execution of privileged functions. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000219-NA CCI-001356 medium The operating system must monitor for atypical usage of operating system accounts. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000222-NA CCI-001372 medium The operating system, when transferring information between different security domains, must implement policy filters constraining data structure and content to organization defined information security policy requirements. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000223-NA CCI-001373 medium The operating system, when transferring information between different security domains, must detect unsanctioned information. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000224-NA CCI-001374 medium The operating system, when transferring information between different security domains, must prohibit the transfer of unsanctioned information in accordance with the security policy. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000225-NA CCI-001376 medium The operating system must uniquely identify source domains for information transfer. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000226-NA CCI-001377 medium The operating system must uniquely authenticate source domains for information transfer. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000227-NA CCI-001383 medium The operating system must provide additional protection for mobile devices accessed via login by purging information from the device after organization defined number of consecutive, unsuccessful login attempts to the mobile device. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000229-NA CCI-000370 medium The operating system must employ automated mechanisms to centrally manage configuration settings. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000233-NA CCI-001391 medium The operating system must notify the user of the number of successful logins/accesses that occur during the organization defined time period. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000234-NA CCI-001392 medium The operating system must notify the user of the number of unsuccessful login/access attempts that occur during organization defined time period. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000235-NA CCI-001395 medium The operating system must notify the user of organization defined security-related changes to the user's account that occur during the organization defined time period. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000238-NA CCI-001401 medium The operating system must support and maintain the binding of organization defined security attributes to information in transmission. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000251-NA CCI-001454 medium The operating system must ensure remote sessions for accessing an organization defined list of security functions and security-relevant information are audited. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000252-NA CCI-001462 medium The operating system must provide the capability to capture/record and log all content related to a user session. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000261-NA CCI-001555 medium The operating system uniquely must identify destination domains for information transfer. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000262-NA CCI-001556 medium The operating system uniquely must authenticate destination domains for information transfer. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000263-NA CCI-001557 medium The operating system must track problems associated with the information transfer. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000267-NA CCI-001632 medium The operating system must protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the information system by either physically separated communications paths or logically separated communications paths. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000268-NA CCI-001662 medium The operating system must take corrective actions, when unauthorized mobile code is identified. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000274-NA CCI-001683 medium The operating system must notify, as required, appropriate individuals when accounts are created. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000275-NA CCI-001684 medium The operating system must notify, as required, appropriate individuals when accounts are modified. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000276-NA CCI-001685 medium The operating system must notify, as required, appropriate individuals when account is disabled. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.
SRG-OS-000277-NA CCI-001686 medium The operating system must notify, as required, appropriate individuals for account termination. The guidance does not meet this requirement. The requirement is impractical or out of scope. If , this is a finding. This requirement is NA. No fix is required.