III - Administrative Public
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000373-GPOS-00158
Group -
TOSS must require reauthentication when using the "sudo" command.
Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, ...Rule Medium Severity -
SRG-OS-000375-GPOS-00160
Group -
TOSS must have the packages required for multifactor authentication installed.
Using an authentication device, such as a DOD Common Access Card (CAC) or token that is separate from the information system, ensures that even if the information system is compromised, credentials...Rule Medium Severity -
SRG-OS-000383-GPOS-00166
Group -
TOSS must prohibit the use of cached authentications after one day.
If cached authentication information is out of date, the validity of the authentication information may be questionable. TOSS includes multiple options for configuring authentication, but this req...Rule Medium Severity -
SRG-OS-000423-GPOS-00187
Group -
All TOSS networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This requireme...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
For TOSS systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured.
To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resol...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The debug-shell systemd service must be disabled on TOSS.
The debug-shell requires no authentication and provides root privileges to anyone who has physical access to the machine. While this feature is disabled by default, masking it adds an additional la...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The root account must be the only account having unrestricted access to the TOSS system.
If an account other than root also has a User Identifier (UID) of "0", it has root authority, giving that account unrestricted access to the entire operating system. Multiple accounts with a UID of...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
The systemd Ctrl-Alt-Delete burst key sequence in TOSS must be disabled.
A locally logged-on user who presses Ctrl-Alt-Delete when at the console can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the r...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
There must be no ".shosts" files on The TOSS operating system.
The ."shosts" files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
TOSS must not allow blank or null passwords in the system-auth file.
If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.