Skip to content
ATO Pathways
  Log In

I - Mission Critical Sensitive

Rules and Groups employed by this XCCDF Profile

  • SRG-OS-000343-GPOS-00134

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure auditd to log space limit problems to syslog.

    &lt;VulnDiscussion&gt;If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to pla...
    Rule Medium Severity
    Show

  • SRG-OS-000366-GPOS-00153

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system RPM package management tool must cryptographically verify the authenticity of all software packages during installation.

    &lt;VulnDiscussion&gt;Installation of any nontrusted software, patches, service packs, device drivers, or operating system components can significa...
    Rule Medium Severity
    Show

  • SRG-OS-000366-GPOS-00153

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system RPM package management tool must cryptographically verify the authenticity of all software packages during installation.

    &lt;VulnDiscussion&gt;Installation of any nontrusted software, patches, service packs, device drivers, or operating system components can significa...
    Rule Medium Severity
    Show

  • SRG-OS-000366-GPOS-00153

    <GroupDescription></GroupDescription>
    Group
    Show

  • The  Photon operating system YUM repository must cryptographically verify the authenticity of all software packages during installation.

    &lt;VulnDiscussion&gt;Installation of any nontrusted software, patches, service packs, device drivers, or operating system components can significa...
    Rule Medium Severity
    Show

  • SRG-OS-000373-GPOS-00156

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must require users to reauthenticate for privilege escalation.

    &lt;VulnDiscussion&gt;Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operat...
    Rule Medium Severity
    Show

  • SRG-OS-000394-GPOS-00174

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure sshd to use FIPS 140-2 ciphers.

    &lt;VulnDiscussion&gt;Privileged access contains control and configuration information and is particularly sensitive, so additional protections are...
    Rule Low Severity
    Show

  • SRG-OS-000433-GPOS-00193

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.

    &lt;VulnDiscussion&gt;ASLR makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's add...
    Rule Medium Severity
    Show

  • SRG-OS-000437-GPOS-00194

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must remove all software components after updated versions have been installed.

    &lt;VulnDiscussion&gt;Previous versions of software components that are not removed from the information system after updates have been installed m...
    Rule Medium Severity
    Show

  • SRG-OS-000458-GPOS-00203

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must generate audit records when the sudo command is used.

    &lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficu...
    Rule Medium Severity
    Show

  • SRG-OS-000470-GPOS-00214

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must generate audit records when successful/unsuccessful logon attempts occur.

    &lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficu...
    Rule Medium Severity
    Show

  • SRG-OS-000471-GPOS-00216

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must audit the "insmod" module.

    &lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficu...
    Rule Medium Severity
    Show

  • SRG-OS-000476-GPOS-00221

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system auditd service must generate audit records for all account creations, modifications, disabling, and termination events.

    &lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficu...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00225

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must use the "pam_cracklib" module.

    &lt;VulnDiscussion&gt;If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00226

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must set the "FAIL_DELAY" parameter.

    &lt;VulnDiscussion&gt;Limiting the number of logon attempts over a certain time interval reduces the chances that an unauthorized user may gain acc...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00226

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

    &lt;VulnDiscussion&gt;Limiting the number of logon attempts over a certain time interval reduces the chances that an unauthorized user may gain acc...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must ensure audit events are flushed to disk at proper intervals.

    &lt;VulnDiscussion&gt;Without setting a balance between performance and ensuring all audit events are written to disk, performance of the system ma...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must create a home directory for all new local interactive user accounts.

    &lt;VulnDiscussion&gt;If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files th...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must disable the debug-shell service.

    &lt;VulnDiscussion&gt;The debug-shell service is intended to diagnose systemd-related boot issues with various "systemctl" commands. Once enabled a...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure sshd to disallow Generic Security Service Application Program Interface (GSSAPI) authentication.

    &lt;VulnDiscussion&gt;GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure sshd to disable environment processing.

    &lt;VulnDiscussion&gt;Enabling environment processing may enable users to bypass access restrictions in some configurations and must therefore be d...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure sshd to disable X11 forwarding.

    &lt;VulnDiscussion&gt;X11 is an older, insecure graphics forwarding protocol. It is not used by Photon and should be disabled as a general best pra...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure sshd to perform strict mode checking of home directory configuration files.

    &lt;VulnDiscussion&gt;If other users have access to modify user-specific Secure Shell (SSH) configuration files, they may be able to log on to the ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure sshd to disallow Kerberos authentication.

    &lt;VulnDiscussion&gt;If Kerberos is enabled through Secure Shell (SSH), sshd provides a means of access to the system's Kerberos implementation. V...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure sshd to disallow authentication with an empty password.

    &lt;VulnDiscussion&gt;Blank passwords are one of the first things an attacker checks for when probing a system. Even is the user somehow has a blan...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Photon operating system must configure sshd to disallow compression of the encrypted session stream.

    &lt;VulnDiscussion&gt;If compression is allowed in a Secure Shell (SSH) connection prior to authentication, vulnerabilities in the compression soft...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules