Skip to content
ATO Pathways
  Log In

I - Mission Critical Classified

Rules and Groups employed by this XCCDF Profile

  • SRG-OS-000023-GPOS-00006

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must display the Standard Mandatory DoD Notice and Consent Banner or equivalent US Government Agency Notice and Consent Banner before granting local or remote access to the system.

    &lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the operating system ensures privacy and se...
    Rule Medium Severity
    Show

  • SRG-OS-000066-GPOS-00034

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

    &lt;VulnDiscussion&gt;Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate n...
    Rule Medium Severity
    Show

  • SRG-OS-000067-GPOS-00035

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS, for PKI-based authentication, must enforce authorized access to the corresponding private key.

    &lt;VulnDiscussion&gt;If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the ne...
    Rule Medium Severity
    Show

  • SRG-OS-000080-GPOS-00048

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must require authentication upon booting into emergency or rescue modes.

    &lt;VulnDiscussion&gt;To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-ap...
    Rule Medium Severity
    Show

  • SRG-OS-000109-GPOS-00056

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must not permit direct logons to the root account using remote access from outside of the system via SSH.

    &lt;VulnDiscussion&gt;Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of...
    Rule Medium Severity
    Show

  • SRG-OS-000114-GPOS-00059

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS file system automounter must be disabled unless required.

    &lt;VulnDiscussion&gt;Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.&lt...
    Rule Medium Severity
    Show

  • SRG-OS-000120-GPOS-00061

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS pam_unix.so module must be configured in the password-auth file to use a FIPS 140-2-approved cryptographic hashing algorithm for system authentication.

    &lt;VulnDiscussion&gt;Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be r...
    Rule Medium Severity
    Show

  • SRG-OS-000120-GPOS-00061

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS pam_unix.so module must be configured in the system-auth file to use a FIPS 140-2-approved cryptographic hashing algorithm for system authentication.

    &lt;VulnDiscussion&gt;Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be r...
    Rule Medium Severity
    Show

  • SRG-OS-000125-GPOS-00065

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS operating system must implement DoD-approved encryption in the OpenSSL package.

    &lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote acce...
    Rule Medium Severity
    Show

  • SRG-OS-000134-GPOS-00068

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must use a Linux Security Module configured to enforce limits on system services.

    &lt;VulnDiscussion&gt;An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform...
    Rule Medium Severity
    Show

  • SRG-OS-000138-GPOS-00069

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must prevent unauthorized and unintended information transfer via shared system resources.

    &lt;VulnDiscussion&gt;Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of infor...
    Rule Medium Severity
    Show

  • SRG-OS-000142-GPOS-00071

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS operating system must be configured to use TCP syncookies.

    &lt;VulnDiscussion&gt;Denial of Service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organizat...
    Rule Medium Severity
    Show

  • SRG-OS-000228-GPOS-00088

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must display the Standard Mandatory DoD Notice and Consent Banner or equivalent US Government Agency Notice and Consent Banner before granting local or remote access to the system via a ssh logon.

    &lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to TOSS ensures privacy and security notificat...
    Rule Low Severity
    Show

  • SRG-OS-000250-GPOS-00093

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.

    &lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote acce...
    Rule Medium Severity
    Show

  • SRG-OS-000250-GPOS-00093

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS operating system must implement DoD-approved TLS encryption in the GnuTLS package.

    &lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Transport L...
    Rule Medium Severity
    Show

  • SRG-OS-000250-GPOS-00093

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS SSH daemon must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.

    &lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote acce...
    Rule Medium Severity
    Show

  • SRG-OS-000269-GPOS-00103

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS operating system must be configured to preserve log records from failure events.

    &lt;VulnDiscussion&gt;Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Fa...
    Rule Medium Severity
    Show

  • SRG-OS-000355-GPOS-00143

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must, for networked systems, compare internal information system clocks at least every 24 hours with a server which is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

    &lt;VulnDiscussion&gt;Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the cor...
    Rule Medium Severity
    Show

  • SRG-OS-000363-GPOS-00150

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TOSS file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency.

    &lt;VulnDiscussion&gt;Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized ...
    Rule Medium Severity
    Show

  • SRG-OS-000366-GPOS-00153

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must prevent the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

    &lt;VulnDiscussion&gt;Changes to any software components can have significant effects on the overall security of the operating system. This require...
    Rule High Severity
    Show

  • SRG-OS-000373-GPOS-00158

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must require reauthentication when using the "sudo" command.

    &lt;VulnDiscussion&gt;Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operat...
    Rule Medium Severity
    Show

  • SRG-OS-000375-GPOS-00160

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must have the packages required for multifactor authentication installed.

    &lt;VulnDiscussion&gt;Using an authentication device, such as a DOD Common Access Card (CAC) or token that is separate from the information system,...
    Rule Medium Severity
    Show

  • SRG-OS-000383-GPOS-00166

    <GroupDescription></GroupDescription>
    Group
    Show

  • TOSS must prohibit the use of cached authentications after one day.

    &lt;VulnDiscussion&gt;If cached authentication information is out of date, the validity of the authentication information may be questionable. TOS...
    Rule Medium Severity
    Show

  • SRG-OS-000423-GPOS-00187

    <GroupDescription></GroupDescription>
    Group
    Show

  • All TOSS networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.

    &lt;VulnDiscussion&gt;Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected commu...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • For TOSS systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured.

    &lt;VulnDiscussion&gt;To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolut...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules