Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-OS-000002-GPOS-00002
Group -
SRG-OS-000142-GPOS-00071
Group -
The Ubuntu operating system must be configured to use TCP syncookies.
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. Managing ex...Rule Medium Severity -
SRG-OS-000355-GPOS-00143
Group -
SRG-OS-000356-GPOS-00144
Group -
The Ubuntu operating system must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when condu...Rule Low Severity -
SRG-OS-000359-GPOS-00146
Group -
SRG-OS-000096-GPOS-00050
Group -
SRG-OS-000184-GPOS-00078
Group -
Kernel core dumps must be disabled unless needed.
Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in denial of service by e...Rule Medium Severity -
SRG-OS-000278-GPOS-00108
Group -
The Ubuntu operating system must use cryptographic mechanisms to protect the integrity of audit tools.
Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit recor...Rule Medium Severity -
SRG-OS-000297-GPOS-00115
Group -
The Ubuntu operating system must enable and run the uncomplicated firewall(ufw).
Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access manage...Rule Medium Severity -
SRG-OS-000363-GPOS-00150
Group -
SRG-OS-000378-GPOS-00163
Group -
The Ubuntu operating system must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.
Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Peripherals include, but are not limited to, such devices as flash drive...Rule Medium Severity -
SRG-OS-000420-GPOS-00186
Group -
SRG-OS-000433-GPOS-00192
Group -
The Ubuntu operating system must implement non-executable data to protect its memory from unauthorized code execution.
Some adversaries launch attacks with the intent of executing code in non-executable regions of memory or in memory locations that are prohibited. Security safeguards employed to protect memory incl...Rule Medium Severity -
SRG-OS-000433-GPOS-00193
Group -
The Ubuntu operating system must implement address space layout randomization to protect its memory from unauthorized code execution.
Some adversaries launch attacks with the intent of executing code in non-executable regions of memory or in memory locations that are prohibited. Security safeguards employed to protect memory incl...Rule Medium Severity -
SRG-OS-000445-GPOS-00199
Group -
SRG-OS-000446-GPOS-00200
Group -
SRG-OS-000480-GPOS-00227
Group -
The Ubuntu operating system must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements.
The security risk of using X11 forwarding is that the client's X11 display server may be exposed to attack when the SSH client requests forwarding. A system administrator may have a stance in which...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The Ubuntu operating system SSH daemon must prevent remote hosts from connecting to the proxy display.
When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the SSHD proxy display is configured to listen on the wildcard address. By default, SSHD binds ...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
All local interactive user home directories defined in the /etc/passwd file must exist.
If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
The Ubuntu operating system must not have accounts configured with blank or null passwords.
If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
The Ubuntu operating system must not allow accounts configured with blank or null passwords.
If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.Rule High Severity -
SRG-OS-000481-GPOS-00481
Group -
The Ubuntu operating system must disable all wireless network adapters.
Without protection of communications with wireless peripherals, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read, altered, or u...Rule Medium Severity -
SRG-OS-000250-GPOS-00093
Group -
The Ubuntu operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
Without cryptographic integrity protections provided by FIPS-validated cryptographic algorithms, information can be viewed and altered by unauthorized users without detection. The system will atte...Rule Medium Severity -
SRG-OS-000138-GPOS-00069
Group -
The Ubuntu operating system must restrict access to the kernel message buffer.
Restricting access to the kernel message buffer limits access only to root. This prevents attackers from gaining additional system information as a nonprivileged user.Rule Low Severity -
SRG-OS-000080-GPOS-00048
Group -
Ubuntu operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
Ubuntu operating systems handling data requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive and tape drive, when used for backups) within an operating system. This re...Rule Medium Severity -
The Ubuntu operating system must implement NIST FIPS-validated cryptography to protect classified information and for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher stand...Rule High Severity -
Advance package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
Changes to any software components can have significant effects on the overall security of the Ubuntu operating system. This requirement ensures the software has not been tampered with and that it ...Rule Medium Severity -
The Ubuntu operating system must not have the rsh-server package installed.
It is detrimental for Ubuntu operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often ov...Rule High Severity -
The Ubuntu operating system must have an application firewall installed in order to control remote access methods.
Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access manage...Rule Medium Severity -
The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon.
The banner must be acknowledged by the user prior to allowing the user access to the operating system. This provides assurance that the user has seen the message and accepted the conditions for acc...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.