Capacity
CCI-000877
Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.
30
Rule
Severity: Medium
Enable PAM
18
Rule
Severity: Medium
Use Only FIPS 140-2 Validated Ciphers
17
Rule
Severity: Medium
Use Only FIPS 140-2 Validated MACs
9
Rule
Severity: High
Set kernel parameter 'crypto.fips_enabled' to 1
7
Rule
Severity: High
Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config
6
Rule
Severity: Medium
Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config
7
Rule
Severity: Medium
Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config
6
Rule
Severity: Medium
Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config
2
Rule
Severity: Medium
The application must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.
4
Rule
Severity: Medium
The DNS server implementation must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
1
Rule
Severity: High
User credentials which would allow remote access to the system by the Service Processor must be removed from the storage system.
1
Rule
Severity: Medium
The Infoblox system must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.
1
Rule
Severity: Medium
The Infoblox system must be configured to employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
1
Rule
Severity: High
Nutanix AOS must implement DoD-approved encryption to protect the confidentiality of remote access sessions.
1
Rule
Severity: Medium
Oracle WebLogic must employ strong identification and authentication techniques when establishing nonlocal maintenance and diagnostic sessions.
2
Rule
Severity: Medium
Common Access Card (CAC)-based authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
1
Rule
Severity: High
The macOS system must implement approved ciphers to protect the confidentiality of SSH connections.
1
Rule
Severity: High
The macOS system must implement approved Message Authentication Codes (MACs).
1
Rule
Severity: High
The macOS system must implement approved Key Exchange Algorithms.
3
Rule
Severity: High
The macOS system must implement approved ciphers within the SSH client configuration to protect the confidentiality of SSH connections.
3
Rule
Severity: High
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration.
3
Rule
Severity: High
The macOS system must implement approved Key Exchange Algorithms within the SSH client configuration.
2
Rule
Severity: High
The macOS system must implement approved ciphers within the SSH server configuration to protect the confidentiality of SSH connections.
2
Rule
Severity: High
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH server configuration.
2
Rule
Severity: High
The macOS system must implement approved Key Exchange Algorithms within the SSH server configuration.
3
Rule
Severity: High
The macOS system must disable password authentication for SSH.
3
Rule
Severity: Medium
The Ubuntu operating system must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
2
Rule
Severity: Medium
The container platform must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.
2
Rule
Severity: High
The operating system must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
2
Rule
Severity: Medium
SSMC must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
2
Rule
Severity: High
AIX must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
2
Rule
Severity: Medium
CA-ACF2 defined user accounts must uniquely identify system users.
2
Rule
Severity: Medium
CA-TSS user accounts must uniquely identify system users.
2
Rule
Severity: Medium
IBM RACF user accounts must uniquely identify system users.
6
Rule
Severity: High
The Windows Remote Management (WinRM) client must not use Basic authentication.
6
Rule
Severity: High
The Windows Remote Management (WinRM) service must not use Basic authentication.
6
Rule
Severity: Medium
The Windows Remote Management (WinRM) client must not use Digest authentication.
2
Rule
Severity: High
Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication.
2
Rule
Severity: Medium
Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication.
2
Rule
Severity: High
Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication.
2
Rule
Severity: High
Windows Server 2022 Windows Remote Management (WinRM) client must not use Basic authentication.
2
Rule
Severity: Medium
Windows Server 2022 Windows Remote Management (WinRM) client must not use Digest authentication.
2
Rule
Severity: High
Windows Server 2022 Windows Remote Management (WinRM) service must not use Basic authentication.
2
Rule
Severity: High
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
2
Rule
Severity: Medium
The Oracle Linux 7 operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.
2
Rule
Severity: Medium
The OL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.
2
Rule
Severity: Medium
The OL 8 SSH server must be configured to use only ciphers employing FIPS 140-2 validated cryptographic algorithms.
2
Rule
Severity: High
Red Hat Enterprise Linux CoreOS (RHCOS) must disable SSHD service.
4
Rule
Severity: Medium
The SUSE operating system SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
2
Rule
Severity: High
RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
2
Rule
Severity: High
RHEL 9 must enable FIPS mode.
4
Rule
Severity: Medium
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
2
Rule
Severity: Medium
The VMM must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
1
Rule
Severity: Medium
The Photon operating system must use an OpenSSH server version that does not support protocol 1.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
1
Rule
Severity: High
SLEM 5 must implement DOD-approved encryption to protect the confidentiality of SSH remote connections.
1
Rule
Severity: High
SLEM 5 SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2/140-3 approved cryptographic hash algorithms.
1
Rule
Severity: Medium
The TOSS operating system must implement DoD-approved encryption in the OpenSSL package.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules