Skip to content
ATO Pathways
  Log In

Red Hat Enterprise Linux 9 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000163-GPOS-00072

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must terminate idle user sessions.

    &lt;VulnDiscussion&gt;Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take c...
    Rule Medium Severity
    Show

  • SRG-OS-000445-GPOS-00199

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must use a Linux Security Module configured to enforce limits on system services.

    &lt;VulnDiscussion&gt;Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed...
    Rule High Severity
    Show

  • SRG-OS-000445-GPOS-00199

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must enable the SELinux targeted policy.

    &lt;VulnDiscussion&gt;Setting the SELinux policy to "targeted" or a more specialized policy ensures the system will confine processes that are like...
    Rule Medium Severity
    Show

  • SRG-OS-000021-GPOS-00005

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must configure SELinux context type to allow the use of a nondefault faillock tally directory.

    &lt;VulnDiscussion&gt;Not having the correct SELinux context on the faillock directory may lead to unauthorized access to the directory.&lt;/VulnDi...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must have policycoreutils package installed.

    &lt;VulnDiscussion&gt;Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 policycoreutils-python-utils package must be installed.

    &lt;VulnDiscussion&gt;The policycoreutils-python-utils package is required to operate and manage an SELinux environment and its policies. It provid...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must have the sudo package installed.

    &lt;VulnDiscussion&gt;"sudo" is a program designed to allow a system administrator to give limited root privileges to users and log root activity. ...
    Rule Medium Severity
    Show

  • SRG-OS-000373-GPOS-00156

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must require reauthentication when using the "sudo" command.

    &lt;VulnDiscussion&gt;Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operat...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must use the invoking user's password for privilege escalation when using "sudo".

    &lt;VulnDiscussion&gt;If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invok...
    Rule Medium Severity
    Show

  • SRG-OS-000373-GPOS-00156

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must require users to reauthenticate for privilege escalation.

    &lt;VulnDiscussion&gt;Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operati...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must restrict privilege elevation to authorized personnel.

    &lt;VulnDiscussion&gt;If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the targ...
    Rule Medium Severity
    Show

  • SRG-OS-000373-GPOS-00156

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must restrict the use of the "su" command.

    &lt;VulnDiscussion&gt;The "su" program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root ...
    Rule Medium Severity
    Show

  • SRG-OS-000370-GPOS-00155

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 fapolicy module must be installed.

    &lt;VulnDiscussion&gt;The organization must identify authorized software programs and permit execution of authorized software. The process used to ...
    Rule Medium Severity
    Show

  • SRG-OS-000370-GPOS-00155

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 fapolicy module must be enabled.

    &lt;VulnDiscussion&gt;The organization must identify authorized software programs and permit execution of authorized software. The process used to ...
    Rule Medium Severity
    Show

  • SRG-OS-000069-GPOS-00037

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.

    &lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, ...
    Rule Medium Severity
    Show

  • SRG-OS-000077-GPOS-00045

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must be configured in the password-auth file to prohibit password reuse for a minimum of five generations.

    &lt;VulnDiscussion&gt;Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute...
    Rule Medium Severity
    Show

  • SRG-OS-000077-GPOS-00045

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must be configured in the system-auth file to prohibit password reuse for a minimum of five generations.

    &lt;VulnDiscussion&gt;Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must not allow blank or null passwords.

    &lt;VulnDiscussion&gt;If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with ...
    Rule High Severity
    Show

  • SRG-OS-000021-GPOS-00005

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.

    &lt;VulnDiscussion&gt;If the pam_faillock.so module is not loaded, the system will not correctly lockout accounts to prevent password guessing atta...
    Rule Medium Severity
    Show

  • SRG-OS-000021-GPOS-00005

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.

    &lt;VulnDiscussion&gt;If the pam_faillock.so module is not loaded, the system will not correctly lockout accounts to prevent password guessing atta...
    Rule Medium Severity
    Show

  • SRG-OS-000069-GPOS-00037

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must ensure the password complexity module is enabled in the password-auth file.

    &lt;VulnDiscussion&gt;Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dict...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must ensure the password complexity module is enabled in the system-auth file.

    &lt;VulnDiscussion&gt;Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dict...
    Rule Medium Severity
    Show

  • SRG-OS-000073-GPOS-00041

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.

    &lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are...
    Rule Medium Severity
    Show

  • SRG-OS-000073-GPOS-00041

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.

    &lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are...
    Rule Medium Severity
    Show

  • SRG-OS-000072-GPOS-00040

    <GroupDescription></GroupDescription>
    Group
    Show

  • RHEL 9 must enforce password complexity rules for the root account.

    &lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, ...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules