Skip to content
ATO Pathways
  Log In

DRAFT - DISA STIG for Oracle Linux 9

Rules and Groups employed by this XCCDF Profile

  • Configure GNOME Screen Locking

    In the default GNOME3 desktop, the screen can be locked by selecting the user name in the far right corner of the main panel and selecting <b>Lock<...
    Group
    Show

  • Set GNOME3 Screensaver Inactivity Timeout

    The idle time-out value for inactivity in the GNOME3 desktop is configured via the <code>idle-delay</code> setting must be set under an appropriate...
    Rule Medium Severity
    Show

  • Set GNOME3 Screensaver Lock Delay After Activation Period

    To activate the locking delay of the screensaver in the GNOME3 desktop when the screensaver is activated, add or set <code>lock-delay</code> to <co...
    Rule Medium Severity
    Show

  • Enable GNOME3 Screensaver Lock After Idle Period

    To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set <code>lock-enabled</code> to <code>true</code> in <c...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <pre>/org/gnome/desktop/screensaver/lock-enab...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Settings

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <code>/org/gnome/desktop/screensaver/lock-del...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Session Idle Settings

    If not already configured, ensure that users cannot change GNOME3 session idle settings by adding <code>/org/gnome/desktop/session/idle-delay</code...
    Rule Medium Severity
    Show

  • GNOME System Settings

    GNOME provides configuration and functionality to a graphical desktop environment that changes grahical configurations or allow a user to perform a...
    Group
    Show

  • Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3

    By default, <code>GNOME</code> will reboot the system if the <code>Ctrl-Alt-Del</code> key sequence is pressed. <br><br> To configure the system to...
    Rule High Severity
    Show

  • Sudo

    <code>Sudo</code>, which stands for "su 'do'", provides the ability to delegate authority to certain users, groups of users, or system administrato...
    Group
    Show

  • Install sudo Package

    The sudo package can be installed with the following command: 
    $ sudo yum install sudo
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate

    The sudo <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having to authenticate. This shoul...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be dis...
    Rule Medium Severity
    Show

  • Require Re-Authentication When Using the sudo Command

    The sudo <code>timestamp_timeout</code> tag sets the amount of time sudo password prompt waits. The default <code>timestamp_timeout</code> value is...
    Rule Medium Severity
    Show

  • The operating system must restrict privilege elevation to authorized personnel

    The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms yo...
    Rule Medium Severity
    Show

  • Ensure invoking users password for privilege escalation when using sudo

    The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validate...
    Rule Medium Severity
    Show

  • System Tooling / Utilities

    The following checks evaluate the system for recommended base packages -- both for installation and removal.
    Group
    Show

  • Ensure gnutls-utils is installed

    The gnutls-utils package can be installed with the following command: 
    $ sudo yum install gnutls-utils
    Rule Medium Severity
    Show

  • Ensure nss-tools is installed

    The nss-tools package can be installed with the following command: 
    $ sudo yum install nss-tools
    Rule Medium Severity
    Show

  • Install rng-tools Package

    The rng-tools package can be installed with the following command: 
    $ sudo yum install rng-tools
    Rule Low Severity
    Show

  • Uninstall gssproxy Package

    The gssproxy package can be removed with the following command: 
    $ sudo yum erase gssproxy
    Rule Medium Severity
    Show

  • Uninstall iprutils Package

    The iprutils package can be removed with the following command: 
    $ sudo yum erase iprutils
    Rule Medium Severity
    Show

  • Uninstall tuned Package

    The tuned package can be removed with the following command: 
    $ sudo yum erase tuned
    Rule Medium Severity
    Show

  • Updating Software

    The <code>yum</code> command line tool is used to install and update software packages. The system also provides a graphical software update tool i...
    Group
    Show

  • Ensure yum Removes Previous Package Versions

    <code>yum</code> should be configured to remove previous software components after new versions have been installed. To configure <code>yum</code> ...
    Rule Low Severity
    Show

  • Ensure gpgcheck Enabled In Main yum Configuration

    The <code>gpgcheck</code> option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check pack...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for Local Packages

    <code>yum</code> should be configured to verify the signature(s) of local packages prior to installation. To configure <code>yum</code> to verify s...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for All yum Package Repositories

    To ensure signature checking is not disabled for any repos, remove any lines from files in <code>/etc/yum.repos.d</code> of the form: <pre>gpgcheck...
    Rule High Severity
    Show

  • Ensure Oracle Linux GPG Key Installed

    To ensure the system can cryptographically verify base software packages come from Oracle (and to connect to the Unbreakable Linux Network to recei...
    Rule High Severity
    Show

  • Ensure Software Patches Installed

    If the system is joined to the ULN or a yum server, run the following command to install updates: <pre>$ sudo yum update</pre> If the system is no...
    Rule Medium Severity
    Show

  • Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which...
    Group
    Show

  • Enable authselect

    Configure user authentication setup to use the <code>authselect</code> tool. If authselect profile is selected, the rule will enable the <xccdf-1.2...
    Rule Medium Severity
    Show

  • Warning Banners for System Accesses

    Each system should expose as little information about itself as possible. <br><br> System banners, which are typically displayed just before a logi...
    Group
    Show

  • Modify the System Login Banner

    To configure the system login banner edit <code>/etc/issue</code>. Replace the default text with a message compliant with the local site policy or...
    Rule Medium Severity
    Show

  • Implement a GUI Warning Banner

    In the default graphical environment, users logging directly into the system are greeted with a login screen provided by the GNOME Display Manager ...
    Group
    Show

  • Enable GNOME3 Login Warning Banner

    In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login scr...
    Rule Medium Severity
    Show

  • Set the GNOME3 Login Warning Banner Text

    In the default graphical environment, configuring the login warning banner text in the GNOME Display Manager's login screen can be configured on th...
    Rule Medium Severity
    Show

  • Protect Accounts by Configuring PAM

    PAM, or Pluggable Authentication Modules, is a system which implements modular authentication for Linux programs. PAM provides a flexible and confi...
    Group
    Show

  • Disallow Configuration to Bypass Password Requirements for Privilege Escalation

    Verify the operating system is not configured to bypass password requirements for privilege escalation. Check the configuration of the "/etc/pam.d/...
    Rule Medium Severity
    Show

  • Ensure PAM Displays Last Logon/Access Notification

    To configure the system to notify users of last logon/access using <code>pam_lastlog</code>, add or correct the <code>pam_lastlog</code> settings i...
    Rule Low Severity
    Show

  • Set Lockouts for Failed Password Attempts

    The <code>pam_faillock</code> PAM module provides the capability to lock out user accounts after a number of failed login attempts. Its documentati...
    Group
    Show

  • Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.

    The pam_faillock.so module must be loaded in preauth in /etc/pam.d/password-auth.
    Rule Medium Severity
    Show

  • Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.

    The pam_faillock.so module must be loaded in preauth in /etc/pam.d/system-auth.
    Rule Medium Severity
    Show

  • An SELinux Context must be configured for the pam_faillock.so records directory

    The <code>dir</code> configuration option in PAM pam_faillock.so module defines where the lockout records is stored. The configured directory must ...
    Rule Medium Severity
    Show

  • Limit Password Reuse: password-auth

    Do not allow users to reuse recent passwords. This can be accomplished by using the <code>remember</code> option for the <code>pam_pwhistory</code>...
    Rule Medium Severity
    Show

  • Limit Password Reuse: system-auth

    Do not allow users to reuse recent passwords. This can be accomplished by using the <code>remember</code> option for the <code>pam_pwhistory</code>...
    Rule Medium Severity
    Show

  • Account Lockouts Must Be Logged

    PAM faillock locks an account due to excessive password failures, this event must be logged.
    Rule Medium Severity
    Show

  • Lock Accounts After Failed Password Attempts

    This rule configures the system to lock out accounts after a number of incorrect login attempts using <code>pam_faillock.so</code>. pam_faillock.so...
    Rule Medium Severity
    Show

  • Configure the root Account for Failed Password Attempts

    This rule configures the system to lock out the <code>root</code> account after a number of incorrect login attempts using <code>pam_faillock.so</c...
    Rule Medium Severity
    Show

  • Lock Accounts Must Persist

    This rule ensures that the system lock out accounts using <code>pam_faillock.so</code> persist after system reboot. From "pam_faillock" man pages: ...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules