Skip to content
ATO Pathways
  Log In

DISA STIG for Red Hat Enterprise Linux 9

Rules and Groups employed by this XCCDF Profile

  • Enable the GNOME3 Screen Locking On Smartcard Removal

    In the default graphical environment, screen locking on smartcard removal can be enabled by setting <code>removal-action</code> to <code>'lock-scre...
    Rule Medium Severity
    Show

  • Disable GDM Automatic Login

    The GNOME Display Manager (GDM) can allow users to automatically login without user interaction or credentials. User should always be required to a...
    Rule High Severity
    Show

  • GNOME Media Settings

    GNOME media settings that apply to the graphical interface.
    Group
    Show

  • Disable GNOME3 Automount Opening

    The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are...
    Rule Medium Severity
    Show

  • Disable GNOME3 Automount running

    The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are...
    Rule Low Severity
    Show

  • Configure GNOME Screen Locking

    In the default GNOME3 desktop, the screen can be locked by selecting the user name in the far right corner of the main panel and selecting <b>Lock<...
    Group
    Show

  • Set GNOME3 Screensaver Inactivity Timeout

    The idle time-out value for inactivity in the GNOME3 desktop is configured via the <code>idle-delay</code> setting must be set under an appropriate...
    Rule Medium Severity
    Show

  • Set GNOME3 Screensaver Lock Delay After Activation Period

    To activate the locking delay of the screensaver in the GNOME3 desktop when the screensaver is activated, add or set <code>lock-delay</code> to <co...
    Rule Medium Severity
    Show

  • Enable GNOME3 Screensaver Lock After Idle Period

    To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set <code>lock-enabled</code> to <code>true</code> in <c...
    Rule Medium Severity
    Show

  • Implement Blank Screensaver

    To set the screensaver mode in the GNOME3 desktop to a blank screen, add or set <code>picture-uri</code> to <code>string ''</code> in <code>/etc...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Settings

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <code>/org/gnome/desktop/screensaver/lock-del...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Session Idle Settings

    If not already configured, ensure that users cannot change GNOME3 session idle settings by adding <code>/org/gnome/desktop/session/idle-delay</code...
    Rule Medium Severity
    Show

  • GNOME System Settings

    GNOME provides configuration and functionality to a graphical desktop environment that changes grahical configurations or allow a user to perform a...
    Group
    Show

  • Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3

    By default, <code>GNOME</code> will reboot the system if the <code>Ctrl-Alt-Del</code> key sequence is pressed. <br><br> To configure the system to...
    Rule High Severity
    Show

  • Sudo

    <code>Sudo</code>, which stands for "su 'do'", provides the ability to delegate authority to certain users, groups of users, or system administrato...
    Group
    Show

  • Install sudo Package

    The sudo package can be installed with the following command: 
    $ sudo dnf install sudo
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate

    The sudo <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having to authenticate. This shoul...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be dis...
    Rule Medium Severity
    Show

  • Require Re-Authentication When Using the sudo Command

    The sudo <code>timestamp_timeout</code> tag sets the amount of time sudo password prompt waits. The default <code>timestamp_timeout</code> value is...
    Rule Medium Severity
    Show

  • The operating system must restrict privilege elevation to authorized personnel

    The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms yo...
    Rule Medium Severity
    Show

  • Ensure invoking users password for privilege escalation when using sudo

    The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validate...
    Rule Medium Severity
    Show

  • System Tooling / Utilities

    The following checks evaluate the system for recommended base packages -- both for installation and removal.
    Group
    Show

  • Ensure gnutls-utils is installed

    The gnutls-utils package can be installed with the following command: 
    $ sudo dnf install gnutls-utils
    Rule Medium Severity
    Show

  • Ensure nss-tools is installed

    The nss-tools package can be installed with the following command: 
    $ sudo dnf install nss-tools
    Rule Medium Severity
    Show

  • Install rng-tools Package

    The rng-tools package can be installed with the following command: 
    $ sudo dnf install rng-tools
    Rule Low Severity
    Show

  • Install subscription-manager Package

    The subscription-manager package can be installed with the following command: 
    $ sudo dnf install subscription-manager
    Rule Medium Severity
    Show

  • Uninstall gssproxy Package

    The gssproxy package can be removed with the following command: 
    $ sudo dnf erase gssproxy
    Rule Medium Severity
    Show

  • Uninstall iprutils Package

    The iprutils package can be removed with the following command: 
    $ sudo dnf erase iprutils
    Rule Medium Severity
    Show

  • Uninstall tuned Package

    The tuned package can be removed with the following command: 
    $ sudo dnf erase tuned
    Rule Medium Severity
    Show

  • Updating Software

    The <code>dnf</code> command line tool is used to install and update software packages. The system also provides a graphical software update tool i...
    Group
    Show

  • Ensure dnf Removes Previous Package Versions

    <code>dnf</code> should be configured to remove previous software components after new versions have been installed. To configure <code>dnf</code> ...
    Rule Low Severity
    Show

  • Ensure gpgcheck Enabled In Main dnf Configuration

    The <code>gpgcheck</code> option controls whether RPM packages' signatures are always checked prior to installation. To configure dnf to check pack...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for Local Packages

    <code>dnf</code> should be configured to verify the signature(s) of local packages prior to installation. To configure <code>dnf</code> to verify s...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for All dnf Package Repositories

    To ensure signature checking is not disabled for any repos, remove any lines from files in <code>/etc/yum.repos.d</code> of the form: <pre>gpgcheck...
    Rule High Severity
    Show

  • Ensure Red Hat GPG Key Installed

    To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them),...
    Rule High Severity
    Show

  • Ensure Software Patches Installed



    NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy dictates.
    Rule Medium Severity
    Show

  • Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which...
    Group
    Show

  • Enable authselect

    Configure user authentication setup to use the <code>authselect</code> tool. If authselect profile is selected, the rule will enable the <xccdf-1.2...
    Rule Medium Severity
    Show

  • Warning Banners for System Accesses

    Each system should expose as little information about itself as possible. <br><br> System banners, which are typically displayed just before a logi...
    Group
    Show

  • Modify the System Login Banner

    To configure the system login banner edit <code>/etc/issue</code>. Replace the default text with a message compliant with the local site policy or...
    Rule Medium Severity
    Show

  • Implement a GUI Warning Banner

    In the default graphical environment, users logging directly into the system are greeted with a login screen provided by the GNOME Display Manager ...
    Group
    Show

  • Enable GNOME3 Login Warning Banner

    In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login scr...
    Rule Medium Severity
    Show

  • Protect Accounts by Configuring PAM

    PAM, or Pluggable Authentication Modules, is a system which implements modular authentication for Linux programs. PAM provides a flexible and confi...
    Group
    Show

  • Disallow Configuration to Bypass Password Requirements for Privilege Escalation

    Verify the operating system is not configured to bypass password requirements for privilege escalation. Check the configuration of the "/etc/pam.d/...
    Rule Medium Severity
    Show

  • Ensure PAM Displays Last Logon/Access Notification

    To configure the system to notify users of last logon/access using <code>pam_lastlog</code>, add or correct the <code>pam_lastlog</code> settings i...
    Rule Low Severity
    Show

  • Set Lockouts for Failed Password Attempts

    The <code>pam_faillock</code> PAM module provides the capability to lock out user accounts after a number of failed login attempts. Its documentati...
    Group
    Show

  • Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.

    The pam_faillock.so module must be loaded in preauth in /etc/pam.d/password-auth.
    Rule Medium Severity
    Show

  • Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.

    The pam_faillock.so module must be loaded in preauth in /etc/pam.d/system-auth.
    Rule Medium Severity
    Show

  • An SELinux Context must be configured for the pam_faillock.so records directory

    The <code>dir</code> configuration option in PAM pam_faillock.so module defines where the lockout records is stored. The configured directory must ...
    Rule Medium Severity
    Show

  • Limit Password Reuse: password-auth

    Do not allow users to reuse recent passwords. This can be accomplished by using the <code>remember</code> option for the <code>pam_pwhistory</code>...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules