III - Administrative Public
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000480-GPOS-00227
Group -
The graphical display manager must not be installed on RHEL 8 unless approved.
Internet services that are not required for system or application processes must not be active to decrease the attack surface of the system. Graphical display managers have a long history of securi...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
RHEL 8 network interfaces must not be in promiscuous mode.
Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow them to collect in...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
RHEL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements.
The security risk of using X11 forwarding is that the client's X11 display server may be exposed to attack when the SSH client requests forwarding. A system administrator may have a stance in whic...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The RHEL 8 SSH daemon must prevent remote hosts from connecting to the proxy display.
When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
If the Trivial File Transfer Protocol (TFTP) server is required, the RHEL 8 TFTP daemon must be configured to operate in secure mode.
Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
A File Transfer Protocol (FTP) server package must not be installed unless mission essential on RHEL 8.
The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using ...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
The gssproxy package must not be installed unless mission essential on RHEL 8.
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooke...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The iprutils package must not be installed unless mission essential on RHEL 8.
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooke...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The tuned package must not be installed unless mission essential on RHEL 8.
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooke...Rule Medium Severity -
SRG-OS-000120-GPOS-00061
Group -
The krb5-server package must not be installed on RHEL 8.
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be ...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
RHEL 8 must restrict privilege elevation to authorized personnel.
The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
RHEL 8 must use the invoking user's password for privilege escalation when using "sudo".
The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. If the rootpw, ...Rule Medium Severity -
SRG-OS-000373-GPOS-00156
Group -
RHEL 8 must require re-authentication when using the "sudo" command.
Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability,...Rule Medium Severity -
SRG-OS-000023-GPOS-00006
Group -
RHEL 8 must display a banner before granting local or remote access to the system via a graphical user logon.
Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal ...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require a unique superusers name upon booting into single-user mode and maintenance.
If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all file...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
RHEL 8 operating systems booted with a BIOS must require a unique superusers name upon booting into single-user and maintenance modes.
If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all file...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
RHEL 8 operating systems must require authentication upon booting into emergency mode.
If the system does not require valid root authentication before it boots into emergency or rescue mode, anyone who invokes emergency or rescue mode is granted privileged access to all files on the ...Rule Medium Severity -
SRG-OS-000120-GPOS-00061
Group -
The RHEL 8 pam_unix.so module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be ...Rule Medium Severity -
SRG-OS-000163-GPOS-00072
Group -
RHEL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
Terminating an unresponsive SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or con...Rule Medium Severity -
SRG-OS-000250-GPOS-00093
Group -
The RHEL 8 SSH daemon must be configured to use system-wide crypto policies.
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DoD nonpublic information systems by an auth...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service.
The most important characteristic of a random number generator is its randomness, namely its ability to deliver random numbers that are impossible to predict. Entropy in computer security is assoc...Rule Low Severity -
SRG-OS-000480-GPOS-00227
Group -
The RHEL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements.
Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
RHEL 8 must use a separate file system for /var/tmp.
The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" ...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
All RHEL 8 local interactive user home directory files must have mode 0750 or less permissive.
Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.