Skip to content
Log In

DRAFT - DISA STIG for Oracle Linux 9

Rules and Groups employed by this XCCDF Profile

  • Generate USBGuard Policy

    By default USBGuard when enabled prevents access to all USB devices and this lead to inaccessible system if they use USB mouse/keyboard. To prevent this scenario, the initial policy configuration m...
    Rule Medium Severity
    Show

  • X Window System

    The X Window System implementation included with the system is called X.org.
    Group
    Show

  • Disable X Windows

    Unless there is a mission-critical reason for the system to run a graphical user interface, ensure X is not set to start automatically at boot and remove the X Windows software packages. There is u...
    Group
    Show

  • Disable graphical user interface

    By removing the following packages, the system no longer has X Windows installed. <code>xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland</code> If X Win...
    Rule Medium Severity
    Show

  • Disable X Windows Startup By Setting Default Target

    Systems that do not require a graphical user interface should only boot by default into <code>multi-user.target</code> mode. This prevents accidental booting of the system into a <code>graphical.ta...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.forwarding</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.forwarding=0</pre> To make sure that ...
    Rule Medium Severity
    Show

  • Network Manager

    The NetworkManager daemon configures a variety of network connections. This section discusses how to configure NetworkManager.
    Group
    Show

  • Configure AIDE to Use FIPS 140-2 for Validating Hashes

    By default, the <code>sha512</code> option is added to the <code>NORMAL</code> ruleset in AIDE. If using a custom ruleset or the <code>sha512</code> option is missing, add <code>sha512</code> to th...
    Rule Medium Severity
    Show

  • Configure Logind to terminate idle sessions after certain time of inactivity

    To configure <code>logind</code> service to terminate inactive user sessions after <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_logind_session_timeout" use="legacy"></xccdf-1.2:sub>...
    Rule Medium Severity
    Show

  • Support session locking with tmux (not enforcing)

    The tmux terminal multiplexer is used to implement automatic session locking. It should be started from /etc/bashrc or drop-in files within /etc/profile.d/.
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules