Skip to content
Log In

DISA STIG for Red Hat Enterprise Linux 9

Rules and Groups employed by this XCCDF Profile

  • Disable Compression Or Set Compression to delayed

    Compression is useful for slow network connections over long distances but can cause performance issues on local LANs. If use of compression is required, it should be enabled only after a user has ...
    Rule Medium Severity
    Show

  • Disable SSH Access via Empty Passwords

    Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for <code>PermitEmptyPasswords<...
    Rule High Severity
    Show

  • Disable GSSAPI Authentication

    Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like GSSAPI. <br> The default SSH configuration disallows authentications based on GSSAPI. The appropriate c...
    Rule Medium Severity
    Show

  • Disable Kerberos Authentication

    Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like Kerberos. <br> The default SSH configuration disallows authentication validation through Kerberos. The ...
    Rule Medium Severity
    Show

  • Disable SSH Support for .rhosts Files

    SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via <code>.rhosts</code> files. <br> The default SSH configuration disables su...
    Rule Medium Severity
    Show

  • Disable SSH Root Login

    The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in <code>/etc/ssh/sshd_config.d/00-compliancea...
    Rule Medium Severity
    Show

  • Disable SSH Support for User Known Hosts

    SSH can allow system users to connect to systems if a cache of the remote systems public keys is available. This should be disabled. <br> <br> To ensure this behavior is disabled, add or c...
    Rule Medium Severity
    Show

  • Disable X11 Forwarding

    The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. SSH has the capability to encrypt remote X11 connections when SSH...
    Rule Medium Severity
    Show

  • Do Not Allow SSH Environment Options

    Ensure that users are not able to override environment variables of the SSH daemon. <br> The default SSH configuration disables environment processing. The appropriate configuration is used if no v...
    Rule Medium Severity
    Show

  • Enable PAM

    UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM...
    Rule Medium Severity
    Show

  • Enable Public Key Authentication

    Enable SSH login with public keys. <br> The default SSH configuration enables authentication based on public keys. The appropriate configuration is used if no value is set for <code>PubkeyAuthentic...
    Rule Medium Severity
    Show

  • Enable Use of Strict Mode Checking

    SSHs <code>StrictModes</code> option checks file and ownership permissions in the user's home directory <code>.ssh</code> folder before accepting login. If world- writable permissions are found, lo...
    Rule Medium Severity
    Show

  • Enable SSH Warning Banner

    To enable the warning banner and ensure it is consistent across the system, add or correct the following line in <code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</code>: <pre>Bann...
    Rule Medium Severity
    Show

  • Enable SSH Print Last Log

    Ensure that SSH will display the date and time of the last successful account logon. <br> The default SSH configuration enables print of the date and time of the last login. The appropriate configu...
    Rule Medium Severity
    Show

  • Force frequent session key renegotiation

    The <code>RekeyLimit</code> parameter specifies how often the session key of the is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed.<br> To decrease the d...
    Rule Medium Severity
    Show

  • Set SSH Daemon LogLevel to VERBOSE

    The <code>VERBOSE</code> parameter configures the SSH daemon to record login and logout activity. To specify the log level in SSH, add or correct the following line in <code>/etc/ssh/sshd_config....
    Rule Medium Severity
    Show

  • Prevent remote hosts from connecting to the proxy display

    The SSH daemon should prevent remote hosts from connecting to the proxy display. <br> The default SSH configuration for <code>X11UseLocalhost</code> is <code>yes</code>, which prevents remote hosts...
    Rule Medium Severity
    Show

  • System Security Services Daemon

    The System Security Services Daemon (SSSD) is a system daemon that provides access to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD, openLDAP, MIT Kerberos, ...
    Group
    Show

  • Certificate status checking in SSSD

    Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart...
    Rule Medium Severity
    Show

  • Enable Certmap in SSSD

    SSSD should be configured to verify the certificate of the user or group. To set this up ensure that section like <code>certmap/testing.test/rule_name</code> is setup in <code>/etc/sssd/sssd.conf<...
    Rule Medium Severity
    Show

  • Enable Smartcards in SSSD

    SSSD should be configured to authenticate access to the system using smart cards. To enable smart cards in SSSD, set <code>pam_cert_auth</code> to <code>True</code> under the <code>[pam]</code> sec...
    Rule Medium Severity
    Show

  • SSSD Has a Correct Trust Anchor

    SSSD must have acceptable trust anchor present.
    Rule Medium Severity
    Show

  • Configure SSSD to Expire Offline Credentials

    SSSD should be configured to expire offline credentials after 1 day. Check if SSSD allows cached authentications with the following command: <pre> $ sudo grep cache_credentials /etc/sssd/sssd.conf...
    Rule Medium Severity
    Show

  • USBGuard daemon

    The USBGuard daemon enforces the USB device authorization policy for all USB devices.
    Group
    Show

  • Install usbguard Package

    The usbguard package can be installed with the following command: 
    $ sudo dnf install usbguard
    Rule Medium Severity
    Show

  • Enable the USBGuard Service

    The USBGuard service should be enabled. The usbguard service can be enabled with the following command: 
    $ sudo systemctl enable usbguard.service
    Rule Medium Severity
    Show

  • Log USBGuard daemon audit events using Linux Audit

    To configure USBGuard daemon to log via Linux Audit (as opposed directly to a file), <code>AuditBackend</code> option in <code>/etc/usbguard/usbguard-daemon.conf</code> needs to be set to <code>Lin...
    Rule Low Severity
    Show

  • Generate USBGuard Policy

    By default USBGuard when enabled prevents access to all USB devices and this lead to inaccessible system if they use USB mouse/keyboard. To prevent this scenario, the initial policy configuration m...
    Rule Medium Severity
    Show

  • X Window System

    The X Window System implementation included with the system is called X.org.
    Group
    Show

  • Disable X Windows

    Unless there is a mission-critical reason for the system to run a graphical user interface, ensure X is not set to start automatically at boot and remove the X Windows software packages. There is u...
    Group
    Show

  • Disable graphical user interface

    By removing the following packages, the system no longer has X Windows installed. <code>xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland</code> If X Win...
    Rule Medium Severity
    Show

  • Disable X Windows Startup By Setting Default Target

    Systems that do not require a graphical user interface should only boot by default into <code>multi-user.target</code> mode. This prevents accidental booting of the system into a <code>graphical.ta...
    Rule Medium Severity
    Show

  • Network Manager

    The NetworkManager daemon configures a variety of network connections. This section discusses how to configure NetworkManager.
    Group
    Show

  • NetworkManager DNS Mode Must Be Must Configured

    The DNS processing mode in NetworkManager describes how DNS is processed on the system. Depending the mode some changes the system's DNS may not be respected.
    Rule Medium Severity
    Show

  • Verify Group Who Owns cron.deny

    To properly set the group owner of /etc/cron.deny, run the command: 
    $ sudo chgrp root /etc/cron.deny
    Rule Medium Severity
    Show

  • Verify Owner on cron.deny

    To properly set the owner of /etc/cron.deny, run the command: 
    $ sudo chown root /etc/cron.deny
    Rule Medium Severity
    Show

  • The s-nail Package Is Installed

    A mail server is required for sending emails. The s-nail package can be installed with the following command: 
    $ sudo dnf install s-nail
    Rule Medium Severity
    Show

  • Ensure All User Initialization Files Have Mode 0740 Or Less Permissive

    Set the mode of the user initialization files, including the <code>root</code> user, to <code>0740</code> with the following commands: <pre> $ sudo chmod 0740 /root/.<i>INIT_FILE</i> $ sudo chmod 0...
    Rule Medium Severity
    Show

  • The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist

    The /etc/ssh/sshd_config.d/50-redhat.conf file must exist as it contains important settings to secure SSH.
    Rule Medium Severity
    Show

  • SSHD Must Include System Crypto Policy Config File

    SSHD should follow the system cryptographic policy. In order to accomplish this the SSHD configuration should include the system
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules