Guide to the Secure Configuration of Red Hat Enterprise Linux 9

with profile CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v1.0.0, released 2022-11-28. This profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content.
This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 9. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Evaluation Characteristics

Evaluation target1c89e170-0647-41a5-92c2-4d684c10c563.testing-farm.us-east-1.aws.redhat.com
Benchmark URL#scap_org.open-scap_comp_ssg-rhel9-xccdf.xml
Benchmark IDxccdf_org.ssgproject.content_benchmark_RHEL-9
Benchmark version0.1.69
Profile IDxccdf_org.ssgproject.content_profile_cis
Started at2024-01-31T05:24:24-05:00
Finished at2024-01-31T05:24:46-05:00
Performed byroot
Test systemcpe:/a:redhat:openscap:1.3.8

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Addresses

  • IPv4  127.0.0.1
  • IPv4  10.31.43.179
  • IPv6  0:0:0:0:0:0:0:1
  • IPv6  fe80:0:0:0:cf7:efff:feb8:4af7
  • MAC  00:00:00:00:00:00
  • MAC  0E:F7:EF:B8:4A:F7

Compliance and Scoring

The target system did not satisfy the conditions of 25 rules! Please review rule results and consider applying remediation.

Rule results

296 passed
25 failed
0 other

Severity of failed rules

2 other
6 low
16 medium
1 high

Score

Scoring systemScoreMaximumPercent
urn:xccdf:scoring:default91.642693100.000000
91.64%

Rule Overview

Group rules by:
TitleSeverityResult
Guide to the Secure Configuration of Red Hat Enterprise Linux 9 25x fail
System Settings 21x fail
Installing and Maintaining Software 11x fail
System and Software Integrity 4x fail
Software Integrity Checking 4x fail
Verify Integrity with AIDE 4x fail
Install AIDEmedium
fail
Build and Test AIDE Databasemedium
fail
Configure AIDE to Verify the Audit Toolsmedium
fail
Configure Periodic Execution of AIDEmedium
fail
System Cryptographic Policies
Configure System Cryptography Policyhigh
pass
Configure SSH to use System Crypto Policymedium
pass
Disk Partitioning 6x fail
Ensure /dev/shm is configuredlow
pass
Ensure /home Located On Separate Partitionlow
fail
Ensure /tmp Located On Separate Partitionlow
fail
Ensure /var Located On Separate Partitionlow
fail
Ensure /var/log Located On Separate Partitionlow
fail
Ensure /var/log/audit Located On Separate Partitionlow
fail
Ensure /var/tmp Located On Separate Partitionmedium
fail
GNOME Desktop Environment
Disable the GNOME3 Login User Listmedium
notapplicable
Disable XDMCP in GDMhigh
notapplicable
GNOME Media Settings
Disable GNOME3 Automountingmedium
notapplicable
Disable GNOME3 Automount Openingmedium
notapplicable
Disable GNOME3 Automount runninglow
notapplicable
Configure GNOME Screen Locking
Set GNOME3 Screensaver Inactivity Timeoutmedium
notapplicable
Set GNOME3 Screensaver Lock Delay After Activation Periodmedium
notapplicable
Ensure Users Cannot Change GNOME3 Screensaver Settingsmedium
notapplicable
Ensure Users Cannot Change GNOME3 Session Idle Settingsmedium
notapplicable
Remove the GDM Package Groupmedium
notapplicable
Make sure that the dconf databases are up-to-date with regards to respective keyfileshigh
notapplicable
Sudo 1x fail
Install sudo Packagemedium
pass
Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_ptymedium
pass
Ensure Sudo Logfile Exists - sudo logfilelow
pass
Ensure Users Re-Authenticate for Privilege Escalation - sudomedium
fail
Require Re-Authentication When Using the sudo Commandmedium
pass
Updating Software
Ensure gpgcheck Enabled In Main dnf Configurationhigh
pass
Account and Access Control 5x fail
Warning Banners for System Accesses 1x fail
Enable GNOME3 Login Warning Bannermedium
notapplicable
Modify the System Login Bannermedium
pass
Modify the System Login Banner for Remote Connectionsmedium
pass
Modify the System Message of the Day Bannermedium
fail
Verify Group Ownership of System Login Bannermedium
pass
Verify Group Ownership of System Login Banner for Remote Connectionsmedium
pass
Verify Group Ownership of Message of the Day Bannermedium
pass
Verify ownership of System Login Bannermedium
pass
Verify ownership of System Login Banner for Remote Connectionsmedium
pass
Verify ownership of Message of the Day Bannermedium
pass
Verify permissions on System Login Bannermedium
pass
Verify permissions on System Login Banner for Remote Connectionsmedium
pass
Verify permissions on Message of the Day Bannermedium
pass
Protect Accounts by Configuring PAM 1x fail
Set Lockouts for Failed Password Attempts
Limit Password Reuse: password-authmedium
pass
Limit Password Reuse: system-authmedium
pass
Lock Accounts After Failed Password Attemptsmedium
pass
Set Lockout Time for Failed Password Attemptsmedium
pass
Set Password Quality Requirements 1x fail
Set Password Quality Requirements with pam_pwquality 1x fail
Ensure PAM Enforces Password Requirements - Minimum Different Categoriesmedium
pass
Ensure PAM Enforces Password Requirements - Minimum Lengthmedium
pass
Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Sessionmedium
fail
Set Password Hashing Algorithm
Set Password Hashing Algorithm in /etc/login.defsmedium
pass
Set PAM''s Password Hashing Algorithm - password-authmedium
pass
Set PAM''s Password Hashing Algorithmmedium
pass
Protect Accounts by Restricting Password-Based Login 3x fail
Set Password Expiration Parameters
Set Existing Passwords Maximum Agemedium
pass
Set Existing Passwords Minimum Agemedium
pass
Set Existing Passwords Warning Agemedium
pass
Set existing passwords a period of inactivity before they been lockedmedium
pass
Verify Proper Storage and Existence of Password Hashes
Verify All Account Password Hashes are Shadowedmedium
pass
Ensure all users last password change date is in the pastmedium
pass
All GIDs referenced in /etc/passwd must be defined in /etc/grouplow
pass
Prevent Login to Accounts With Empty Passwordhigh
pass
Ensure There Are No Accounts With Blank or Null Passwordshigh
pass
Verify No .forward Files Existmedium
pass
Verify No netrc Files Existmedium
pass
Restrict Root Logins 3x fail
Verify Only Root Has UID 0high
pass
Verify Root Has A Primary GID 0high
pass
Ensure the Group Used by pam_wheel Module Exists on System and is Emptymedium
fail
Ensure Authentication Required for Single User Modemedium
fail
Ensure that System Accounts Are Lockedmedium
pass
Ensure that System Accounts Do Not Run a Shell Upon Loginmedium
pass
Enforce Usage of pam_wheel with Group Parameter for su Authenticationmedium
fail
Ensure All Groups on the System Have Unique Group IDmedium
pass
Secure Session Configuration Files for Login Accounts
Ensure that No Dangerous Directories Exist in Root's Path
Ensure that Root's Path Does Not Include World or Group-Writable Directoriesmedium
pass
Ensure that Root's Path Does Not Include Relative Paths or Null Directoriesunknown
pass
Ensure that Users Have Sensible Umask Values
Ensure the Default Bash Umask is Set Correctlymedium
pass
Ensure the Default Umask is Set Correctly in /etc/profilemedium
pass
Set Interactive Session Timeoutmedium
pass
User Initialization Files Must Not Run World-Writable Programsmedium
pass
All Interactive Users Home Directories Must Existmedium
pass
All Interactive User Home Directories Must Be Group-Owned By The Primary Groupmedium
pass
All Interactive User Home Directories Must Have mode 0750 Or Less Permissivemedium
pass
Enable authselectmedium
pass
System Accounting with auditd 1x fail
Configure auditd Rules for Comprehensive Auditing 1x fail
Record Events that Modify the System's Discretionary Access Controls
Record Events that Modify the System's Discretionary Access Controls - chmodmedium
pass
Record Events that Modify the System's Discretionary Access Controls - chownmedium
pass
Record Events that Modify the System's Discretionary Access Controls - fchmodmedium
pass
Record Events that Modify the System's Discretionary Access Controls - fchmodatmedium
pass
Record Events that Modify the System's Discretionary Access Controls - fchownmedium
pass
Record Events that Modify the System's Discretionary Access Controls - fchownatmedium
pass
Record Events that Modify the System's Discretionary Access Controls - fremovexattrmedium
pass
Record Events that Modify the System's Discretionary Access Controls - fsetxattrmedium
pass
Record Events that Modify the System's Discretionary Access Controls - lchownmedium
pass
Record Events that Modify the System's Discretionary Access Controls - lremovexattrmedium
pass
Record Events that Modify the System's Discretionary Access Controls - lsetxattrmedium
pass
Record Events that Modify the System's Discretionary Access Controls - removexattrmedium
pass
Record Events that Modify the System's Discretionary Access Controls - setxattrmedium
pass
Record Execution Attempts to Run ACL Privileged Commands
Record Any Attempts to Run chaclmedium
pass
Record Any Attempts to Run setfaclmedium
pass
Record Execution Attempts to Run SELinux Privileged Commands
Record Any Attempts to Run chconmedium
pass
Record File Deletion Events by User
Ensure auditd Collects File Deletion Events by User - renamemedium
pass
Ensure auditd Collects File Deletion Events by User - renameatmedium
pass
Ensure auditd Collects File Deletion Events by User - unlinkatmedium
pass
Record Unauthorized Access Attempts Events to Files (unsuccessful)
Record Unsuccessful Access Attempts to Files - creatmedium
pass
Record Unsuccessful Access Attempts to Files - ftruncatemedium
pass
Record Unsuccessful Access Attempts to Files - openmedium
pass
Record Unsuccessful Access Attempts to Files - openatmedium
pass
Record Unsuccessful Access Attempts to Files - truncatemedium
pass
Record Information on Kernel Modules Loading and Unloading
Ensure auditd Collects Information on Kernel Module Unloading - create_modulemedium
pass
Ensure auditd Collects Information on Kernel Module Unloading - delete_modulemedium
pass
Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_modulemedium
pass
Ensure auditd Collects Information on Kernel Module Loading - init_modulemedium
pass
Ensure auditd Collects Information on Kernel Module Loading and Unloading - query_modulemedium
pass
Record Information on the Use of Privileged Commands 1x fail
Ensure auditd Collects Information on the Use of Privileged Commandsmedium
fail
Ensure auditd Collects Information on the Use of Privileged Commands - kmodmedium
pass
Ensure auditd Collects Information on the Use of Privileged Commands - usermodmedium
pass
Records Events that Modify Date and Time Information
Record attempts to alter time through adjtimexmedium
pass
Record Attempts to Alter Time Through clock_settimemedium
pass
Record attempts to alter time through settimeofdaymedium
pass
Record Attempts to Alter Time Through stimemedium
pass
Record Attempts to Alter the localtime Filemedium
pass
Make the auditd Configuration Immutablemedium
pass
Record Events that Modify the System's Mandatory Access Controlsmedium
pass
Record Events that Modify the System's Mandatory Access Controls in usr/sharemedium
pass
Ensure auditd Collects Information on Exporting to Media (successful)medium
pass
Record Events that Modify the System's Network Environmentmedium
pass
Record Attempts to Alter Process and Session Initiation Informationmedium
pass
Record Events When Executables Are Run As Another Usermedium
pass
Ensure auditd Collects System Administrator Actionsmedium
pass
Record Events that Modify User/Group Information - /etc/groupmedium
pass
Record Events that Modify User/Group Information - /etc/gshadowmedium
pass
Record Events that Modify User/Group Information - /etc/security/opasswdmedium
pass
Record Events that Modify User/Group Information - /etc/passwdmedium
pass
Record Events that Modify User/Group Information - /etc/shadowmedium
pass
Record Attempts to perform maintenance activitiesmedium
pass
System Audit Logs Must Have Mode 0750 or Less Permissivemedium
pass
System Audit Logs Must Be Group Owned By Rootmedium
pass
Audit Configuration Files Must Be Owned By Group rootmedium
pass
Audit Configuration Files Must Be Owned By Rootmedium
pass
System Audit Logs Must Be Owned By Rootmedium
pass
Audit Configuration Files Permissions are 640 or More Restrictivemedium
pass
System Audit Logs Must Have Mode 0640 or Less Permissivemedium
pass
Configure auditd Data Retention
Configure auditd mail_acct Action on Low Disk Spacemedium
pass
Configure auditd admin_space_left Action on Low Disk Spacemedium
pass
Configure auditd Max Log File Sizemedium
pass
Configure auditd max_log_file_action Upon Reaching Maximum Log Sizemedium
pass
Configure auditd space_left Action on Low Disk Spacemedium
pass
Ensure the audit Subsystem is Installedmedium
pass
Enable auditd Servicemedium
pass
Enable Auditing for Processes Which Start Prior to the Audit Daemonlow
pass
Extend Audit Backlog Limit for the Audit Daemonlow
pass
GRUB2 bootloader configuration 1x fail
Non-UEFI GRUB2 bootloader configuration 1x fail
Verify /boot/grub2/grub.cfg Group Ownershipmedium
pass
Verify /boot/grub2/user.cfg Group Ownershipmedium
pass
Verify /boot/grub2/grub.cfg User Ownershipmedium
pass
Verify /boot/grub2/user.cfg User Ownershipmedium
pass
Verify /boot/grub2/grub.cfg Permissionsmedium
pass
Verify /boot/grub2/user.cfg Permissionsmedium
pass
Set Boot Loader Password in grub2high
fail
Configure Syslog
Ensure Proper Configuration of Log Files
Ensure Log Files Are Owned By Appropriate Groupmedium
pass
Ensure Log Files Are Owned By Appropriate Usermedium
pass
Ensure System Log Files Have Correct Permissionsmedium
pass
systemd-journald
Enable systemd-journald Servicemedium
pass
Ensure journald is configured to compress large log filesmedium
pass
Ensure journald is configured to send logs to rsyslogmedium
pass
Ensure journald is configured to write log files to persistent diskmedium
pass
Disable systemd-journal-remote Socketmedium
pass
Configure rsyslogd to Accept Remote Messages If Acting as a Log Server
Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Servermedium
pass
Ensure rsyslog is Installedmedium
pass
Enable rsyslog Servicemedium
pass
Ensure rsyslog Default File Permissions Configuredmedium
pass
Network Configuration and Firewalls 3x fail
firewalld 2x fail
Inspect and Activate Default firewalld Rules
Verify firewalld Enabledmedium
notapplicable
Strengthen the Default Ruleset 2x fail
Configure Firewalld to Restrict Loopback Trafficmedium
fail
Configure Firewalld to Trust Loopback Trafficmedium
fail
Set Default firewalld Zone for Incoming Packetsmedium
notapplicable
IPv6
Configure IPv6 Settings if Necessary
Configure Accepting Router Advertisements on All IPv6 Interfacesmedium
pass
Disable Accepting ICMP Redirects for All IPv6 Interfacesmedium
pass
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfacesmedium
pass
Disable Kernel Parameter for IPv6 Forwardingmedium
pass
Disable Accepting Router Advertisements on all IPv6 Interfaces by Defaultmedium
pass
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfacesmedium
pass
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Defaultmedium
pass
Kernel Parameters Which Affect Networking
Network Related Kernel Runtime Parameters for Hosts and Routers
Disable Accepting ICMP Redirects for All IPv4 Interfacesmedium
pass
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfacesmedium
pass
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfacesunknown
pass
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfacesmedium
pass
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfacesmedium
pass
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfacesmedium
pass
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Defaultmedium
pass
Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Defaultunknown
pass
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Defaultmedium
pass
Configure Kernel Parameter for Accepting Secure Redirects By Defaultmedium
pass
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfacesmedium
pass
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfacesunknown
pass
Enable Kernel Parameter to Use TCP Syncookies on Network Interfacesmedium
pass
Network Parameters for Hosts Only
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfacesmedium
pass
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Defaultmedium
pass
Disable Kernel Parameter for IP Forwarding on IPv4 Interfacesmedium
pass
nftables 1x fail
Install nftables Packagemedium
fail
Verify nftables Service is Disabledmedium
pass
Ensure a Table Exists for Nftablesmedium
notapplicable
Uncommon Network Protocols
Disable TIPC Supportlow
pass
Wireless Networking
Disable Wireless Through Software Configuration
Deactivate Wireless Network Interfacesmedium
notapplicable
File Permissions and Masks
Verify Permissions on Important Files and Directories
Verify Group Who Owns Backup group Filemedium
pass
Verify Group Who Owns Backup gshadow Filemedium
pass
Verify Group Who Owns Backup passwd Filemedium
pass
Verify User Who Owns Backup shadow Filemedium
pass
Verify Group Who Owns group Filemedium
pass
Verify Group Who Owns gshadow Filemedium
pass
Verify Group Who Owns passwd Filemedium
pass
Verify Group Who Owns shadow Filemedium
pass
Verify User Who Owns Backup group Filemedium
pass
Verify User Who Owns Backup gshadow Filemedium
pass
Verify User Who Owns Backup passwd Filemedium
pass
Verify Group Who Owns Backup shadow Filemedium
pass
Verify User Who Owns group Filemedium
pass
Verify User Who Owns gshadow Filemedium
pass
Verify User Who Owns passwd Filemedium
pass
Verify User Who Owns shadow Filemedium
pass
Verify Permissions on Backup group Filemedium
pass
Verify Permissions on Backup gshadow Filemedium
pass
Verify Permissions on Backup passwd Filemedium
pass
Verify Permissions on Backup shadow Filemedium
pass
Verify Permissions on group Filemedium
pass
Verify Permissions on gshadow Filemedium
pass
Verify Permissions on passwd Filemedium
pass
Verify Permissions on shadow Filemedium
pass
Verify File Permissions Within Some Important Directories
Verify that audit tools are owned by group rootmedium
pass
Verify that audit tools are owned by rootmedium
pass
Verify that audit tools Have Mode 0755 or lessmedium
pass
Verify that All World-Writable Directories Have Sticky Bits Setmedium
pass
Ensure No World-Writable Files Existmedium
pass
Ensure All Files Are Owned by a Groupmedium
pass
Ensure All Files Are Owned by a Usermedium
pass
Restrict Dynamic Mounting and Unmounting of Filesystems
Disable Mounting of squashfslow
pass
Disable Mounting of udflow
pass
Disable Modprobe Loading of USB Storage Drivermedium
pass
Restrict Partition Mount Options
Add nodev Option to /dev/shmmedium
pass
Add noexec Option to /dev/shmmedium
pass
Add nosuid Option to /dev/shmmedium
pass
Add nodev Option to /homeunknown
notapplicable
Add nosuid Option to /homemedium
notapplicable
Add nodev Option to /tmpmedium
notapplicable
Add noexec Option to /tmpmedium
notapplicable
Add nosuid Option to /tmpmedium
notapplicable
Add nodev Option to /var/log/auditmedium
notapplicable
Add noexec Option to /var/log/auditmedium
notapplicable
Add nosuid Option to /var/log/auditmedium
notapplicable
Add nodev Option to /var/logmedium
notapplicable
Add noexec Option to /var/logmedium
notapplicable
Add nosuid Option to /var/logmedium
notapplicable
Add nodev Option to /varmedium
notapplicable
Add nosuid Option to /varunknown
pass
Add nodev Option to /var/tmpmedium
notapplicable
Add noexec Option to /var/tmpmedium
notapplicable
Add nosuid Option to /var/tmpmedium
notapplicable
Restrict Programs from Dangerous Execution Patterns
Disable Core Dumps
Disable core dump backtracesmedium
pass
Disable storing core dumpmedium
pass
Enable ExecShield
Enable Randomized Layout of Virtual Address Spacemedium
pass
SELinux
Install libselinux Packagehigh
pass
Uninstall mcstrans Packagelow
pass
Uninstall setroubleshoot Packagelow
pass
Ensure SELinux Not Disabled in /etc/default/grubmedium
pass
Ensure No Daemons are Unconfined by SELinuxmedium
pass
Ensure SELinux is Not Disabledhigh
pass
Configure SELinux Policymedium
pass
Ensure SELinux State is Enforcinghigh
pass
Services 4x fail
Avahi Server
Disable Avahi Server if Possible
Uninstall avahi Server Packagemedium
pass
Cron and At Daemons
Restrict at and cron to Authorized Users if Necessary
Ensure that /etc/at.deny does not existmedium
pass
Ensure that /etc/cron.deny does not existmedium
pass
Verify Group Who Owns /etc/at.allow filemedium
pass
Verify Group Who Owns /etc/cron.allow filemedium
pass
Verify User Who Owns /etc/cron.allow filemedium
pass
Verify Permissions on /etc/at.allow filemedium
pass
Verify Permissions on /etc/cron.allow filemedium
pass
Enable cron Servicemedium
pass
Verify Group Who Owns cron.dmedium
pass
Verify Group Who Owns cron.dailymedium
pass
Verify Group Who Owns cron.hourlymedium
pass
Verify Group Who Owns cron.monthlymedium
pass
Verify Group Who Owns cron.weeklymedium
pass
Verify Group Who Owns Crontabmedium
pass
Verify Owner on cron.dmedium
pass
Verify Owner on cron.dailymedium
pass
Verify Owner on cron.hourlymedium
pass
Verify Owner on cron.monthlymedium
pass
Verify Owner on cron.weeklymedium
pass
Verify Owner on crontabmedium
pass
Verify Permissions on cron.dmedium
pass
Verify Permissions on cron.dailymedium
pass
Verify Permissions on cron.hourlymedium
pass
Verify Permissions on cron.monthlymedium
pass
Verify Permissions on cron.weeklymedium
pass
Verify Permissions on crontabmedium
pass
DHCP
Disable DHCP Server
Uninstall DHCP Server Packagemedium
pass
DNS Server
Disable DNS Server
Uninstall bind Packagelow
pass
Uninstall dnsmasq Packagelow
pass
FTP Server
Disable vsftpd if Possible
Uninstall vsftpd Packagehigh
pass
Remove ftp Packagelow
pass
Web Server
Disable Apache if Possible
Uninstall httpd Packageunknown
pass
Disable NGINX if Possible
Uninstall nginx Packageunknown
pass
IMAP and POP3 Server
Disable Cyrus IMAP
Uninstall cyrus-imapd Packageunknown
pass
Disable Dovecot
Uninstall dovecot Packageunknown
pass
LDAP
Configure OpenLDAP Clients
Ensure LDAP client is not installedlow
pass
Mail Server Software
Configure SMTP For Mail Clients
Disable Postfix Network Listeningmedium
notapplicable
Ensure Mail Transfer Agent is not Listening on any non-loopback Addressmedium
pass
NFS and RPC 2x fail
Disable All NFS Services if Possible 1x fail
Disable Services Used Only by NFS 1x fail
Disable rpcbind Servicelow
fail
Configure NFS Clients 1x fail
Disable NFS Server Daemons 1x fail
Disable Network File System (nfs)unknown
fail
Network Time Protocol
Ensure that chronyd is running under chrony user accountmedium
pass
A remote time server for Chrony is configuredmedium
pass
Obsolete Services
Rlogin, Rsh, and Rexec
Remove Rsh Trust Fileshigh
pass
Telnet
Uninstall telnet-server Packagehigh
pass
Remove telnet Clientslow
pass
TFTP Server
Uninstall tftp-server Packagehigh
pass
Remove tftp Daemonlow
pass
Uninstall rsync Packagemedium
pass
Print Support
Uninstall CUPS Packageunknown
pass
Proxy Server
Disable Squid if Possible
Uninstall squid Packageunknown
pass
Samba(SMB) Microsoft Windows File Sharing Server
Disable Samba if Possible
Uninstall Samba Packageunknown
pass
SNMP Server
Disable SNMP Server if Possible
Uninstall net-snmp Packageunknown
pass
SSH Server 2x fail
Configure OpenSSH Server if Necessary 2x fail
Set SSH Client Alive Count Maxmedium
pass
Disable Host-Based Authenticationmedium
pass
Disable SSH Access via Empty Passwordshigh
pass
Disable SSH Support for .rhosts Filesmedium
pass
Disable SSH Root Loginmedium
fail
Disable SSH TCP Forwardingmedium
pass
Disable X11 Forwardingmedium
pass
Do Not Allow SSH Environment Optionsmedium
pass
Enable PAMmedium
pass
Enable SSH Warning Bannermedium
pass
Limit Users' SSH Accessunknown
fail
Set SSH Daemon LogLevel to VERBOSEmedium
pass
Set SSH authentication attempt limitmedium
pass
Set SSH MaxSessions limitmedium
pass
Ensure SSH MaxStartups is configuredmedium
pass
Verify Group Who Owns SSH Server config filemedium
pass
Verify Group Ownership on SSH Server Private *_key Key Filesmedium
pass
Verify Group Ownership on SSH Server Public *.pub Key Filesmedium
pass
Verify Owner on SSH Server config filemedium
pass
Verify Ownership on SSH Server Private *_key Key Filesmedium
pass
Verify Ownership on SSH Server Public *.pub Key Filesmedium
pass
Verify Permissions on SSH Server config filemedium
pass
Verify Permissions on SSH Server Private *_key Key Filesmedium
pass
Verify Permissions on SSH Server Public *.pub Key Filesmedium
pass
X Window System
Disable X Windows
Remove the X Windows Package Groupmedium
pass

Result Details

Install AIDExccdf_org.ssgproject.content_rule_package_aide_installed mediumCCE-90843-4

Install AIDE

Rule IDxccdf_org.ssgproject.content_rule_package_aide_installed
Result
fail
Multi-check ruleno
OVAL Definition IDoval:ssg-package_aide_installed:def:1
Time2024-01-31T05:24:24-05:00
Severitymedium
Identifiers and References

Identifiers:  CCE-90843-4

References:  BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, RHEL-09-651010, 1.3.1, SV-258134r926389_rule

Description
The aide package can be installed with the following command:
$ sudo dnf install aide
Rationale
The AIDE package must be installed if it is to be available for integrity checking.

Complexity:low
Disruption:low
Reboot:false
Strategy:enable
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Complexity:low
Disruption:low
Reboot:false
Strategy:enable
- name: Ensure aide is installed
  package:
    name: aide
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-90843-4
  - CJIS-5.10.1.3
  - DISA-STIG-RHEL-09-651010
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_aide_installed

Complexity:low
Disruption:low
Reboot:false
Strategy:enable
include install_aide

class install_aide {
  package { 'aide':
    ensure => 'installed',
  }
}

Complexity:low
Disruption:low
Reboot:false
Strategy:enable

package --add=aide


[[packages]]
name = "aide"
version = "*"
OVAL test results details

package aide is installed  oval:ssg-test_package_aide_installed:tst:1  false

No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_aide_installed:obj:1 of type rpminfo_object
Name
aide
Build and Test AIDE Databasexccdf_org.ssgproject.content_rule_aide_build_database mediumCCE-83438-2

Build and Test AIDE Database

Rule IDxccdf_org.ssgproject.content_rule_aide_build_database
Result
fail
Multi-check ruleno
OVAL Definition IDoval:ssg-aide_build_database:def:1
Time2024-01-31T05:24:24-05:00
Severitymedium
Identifiers and References

Identifiers:  CCE-83438-2

References:  BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1

Description
Run the following command to generate a new database:
$ sudo /usr/sbin/aide --init
By default, the database will be written to the file /var/lib/aide/aide.db.new.gz. Storing the database, the configuration file /etc/aide.conf, and the binary /usr/sbin/aide (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:
$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
To initiate a manual check, run the following command:
$ sudo /usr/sbin/aide --check
If this check produces any unexpected output, investigate.
Rationale
For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

/usr/sbin/aide --init
/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Complexity:low
Disruption:low
Reboot:false
Strategy:restrict
- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-83438-2
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database
  command: /usr/sbin/aide --init
  changed_when: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-83438-2
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check whether the stock AIDE Database exists
  stat:
    path: /var/lib/aide/aide.db.new.gz
  register: aide_database_stat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-83438-2
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Stage AIDE Database
  copy:
    src: /var/lib/aide/aide.db.new.gz
    dest: /var/lib/aide/aide.db.gz
    backup: true
    remote_src: true
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)
  tags:
  - CCE-83438-2
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
OVAL test results details

package aide is installed  oval:ssg-test_package_aide_installed:tst:1  false

No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_aide_installed:obj:1 of type rpminfo_object
Name
aide

Testing existence of operational aide database file  oval:ssg-test_aide_operational_database_absolute_path:tst:1  false

No items have been found conforming to the following objects:
Object oval:ssg-object_aide_operational_database_absolute_path:obj:1 of type file_object
Filepath
Referenced variable has no values (oval:ssg-variable_aide_operational_database_absolute_path:var:1)
Configure AIDE to Verify the Audit Toolsxccdf_org.ssgproject.content_rule_aide_check_audit_tools mediumCCE-87757-1

Configure AIDE to Verify the Audit Tools

Rule IDxccdf_org.ssgproject.content_rule_aide_check_audit_tools
Result
fail
Multi-check ruleno
OVAL Definition IDoval:ssg-aide_check_audit_tools:def:1
Time2024-01-31T05:24:24-05:00
Severitymedium
Identifiers and References

Identifiers:  CCE-87757-1

References:  CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, RHEL-09-651025, 1.3.3, SV-258137r926398_rule

Description
The operating system file integrity tool must be configured to protect the integrity of the audit tools.
Rationale
Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit tools include but are not limited to vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files.

Complexity:low
Disruption:low
Reboot:false
Strategy:restrict
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi










if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/aureport.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/autrace.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/