Skip to content
ATO Pathways
  Log In

Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • TOSS must use multifactor authentication for network and local access to privileged and nonprivileged accounts.

    <VulnDiscussion>Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor ...
    Rule Medium Severity
    Show

  • SRG-OS-000118-GPOS-00060

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

    &lt;VulnDiscussion&gt;Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potenti...
    Rule Medium Severity
    Show

  • SRG-OS-000123-GPOS-00064

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.

    &lt;VulnDiscussion&gt;Emergency accounts are privileged accounts that are established in response to crisis situations where the need for rapid acc...
    Rule Medium Severity
    Show

  • SRG-OS-000206-GPOS-00084

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must reveal error messages only to authorized users.

    &lt;VulnDiscussion&gt;Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an orga...
    Rule Medium Severity
    Show

  • SRG-OS-000299-GPOS-00117

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must protect wireless access to the system using authentication of users and/or devices.

    &lt;VulnDiscussion&gt;Allowing devices and users to connect to the system without first authenticating them allows untrusted access and can lead to...
    Rule Medium Severity
    Show

  • SRG-OS-000329-GPOS-00128

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes occur.

    &lt;VulnDiscussion&gt;By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise...
    Rule Medium Severity
    Show

  • SRG-OS-000373-GPOS-00156

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must require users to reauthenticate for privilege escalation.

    &lt;VulnDiscussion&gt;Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operat...
    Rule Medium Severity
    Show

  • SRG-OS-000373-GPOS-00157

    <GroupDescription></GroupDescription>
    Group
    Show

  • All TOSS local interactive user home directories must be group-owned by the home directory owner's primary group.

    &lt;VulnDiscussion&gt;If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary GID of the user, th...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • All TOSS local interactive users must have a home directory assigned in the /etc/passwd file.

    &lt;VulnDiscussion&gt;If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files th...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The x86 Ctrl-Alt-Delete key sequence in TOSS must be disabled if a graphical user interface is installed.

    &lt;VulnDiscussion&gt;A locally logged-on user, who presses Ctrl-Alt-Delete when at the console, can reboot the system. If accidentally pressed, as...
    Rule High Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must disable the user list at logon for graphical user interfaces.

    &lt;VulnDiscussion&gt;Leaving the user list enabled is a security risk since it allows anyone with physical access to the system to enumerate known...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must display the date and time of the last successful account logon upon an SSH logon.

    &lt;VulnDiscussion&gt;Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of un...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must not allow accounts configured with blank or null passwords.

    &lt;VulnDiscussion&gt;If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with ...
    Rule High Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must not have unnecessary accounts.

    &lt;VulnDiscussion&gt;Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts includ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00228

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS audit logs must have a mode of 0600 or less permissive to prevent unauthorized read access.

    &lt;VulnDiscussion&gt;Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confide...
    Rule Medium Severity
    Show

  • SRG-OS-000057-GPOS-00027

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

    &lt;VulnDiscussion&gt;Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing ...
    Rule Medium Severity
    Show

  • SRG-OS-000037-GPOS-00015

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.

    &lt;VulnDiscussion&gt;Without establishing what type of events occurred, when events occurred, the source of events, where events occurred, and the...
    Rule Medium Severity
    Show

  • SRG-OS-000042-GPOS-00020

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must generate audit records containing the full-text recording of privileged commands.

    &lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At...
    Rule Medium Severity
    Show

  • SRG-OS-000046-GPOS-00022

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.

    &lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required....
    Rule Medium Severity
    Show

  • SRG-OS-000047-GPOS-00023

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must take appropriate action when an audit processing failure occurs.

    &lt;VulnDiscussion&gt;It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mit...
    Rule Medium Severity
    Show

  • TOSS audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.

    &lt;VulnDiscussion&gt;Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confide...
    Rule Medium Severity
    Show

  • SRG-OS-000057-GPOS-00027

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS audit logs must be owned by user root to prevent unauthorized read access.

    &lt;VulnDiscussion&gt;Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confide...
    Rule Medium Severity
    Show

  • SRG-OS-000057-GPOS-00027

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS audit logs must be owned by group root to prevent unauthorized read access.

    &lt;VulnDiscussion&gt;Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confide...
    Rule Medium Severity
    Show

  • SRG-OS-000057-GPOS-00027

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS audit log directory must be owned by user root to prevent unauthorized read access.

    &lt;VulnDiscussion&gt;Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confide...
    Rule Medium Severity
    Show

  • SRG-OS-000057-GPOS-00027

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS audit log directory must be owned by group root to prevent unauthorized read access.

    &lt;VulnDiscussion&gt;Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confide...
    Rule Medium Severity
    Show

  • SRG-OS-000057-GPOS-00027

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS audit system must protect auditing rules from unauthorized change.

    &lt;VulnDiscussion&gt;Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confide...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules