Coverage - DISA, Linux

To apply these profiles to your systems, see DISA enforcement on Linux.

Current revisions

Operating System	Source Benchmark version
Oracle Linux 8	V2R2
Red Hat Enterprise Linux 8	V2R1
Red Hat Enterprise Linux 9	V2R2

Control Coverage

Summary

OS	Unmapped Controls	Paper Policy	Mapped	Total
OracleLinux 8	15 (6%)		229 (93%)	244
RedHat 8	17 (7%)		213 (92%)	230
RedHat 9	49 (12%)		355 (87%)	404

---

Detail

Unmapped Controls

The following controls are not mapped:

OracleLinux 8 (15/244 [6%])

Control	Title	Notes
V-248534	OL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.	Locking a user due to inappropriate encryption is not currently available in simp. A mechanism to address this rule will be implemented in a future release.
V-248545	OL 8 must prevent system daemons from using Kerberos for authentication.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-248565	The OL 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package.	There is currently no mechanism to control the content of /etc/crypto-policies/back-ends/opensslcnf.config. One may be implemented in the future.
V-248567	OL 8 system commands must have mode 755 or less permissive.	We do not currently have a mechanism for scanning the filesystem's for enforcement.
V-248619	OL 8 must prevent special devices on non-root local partitions.	There is no way to safely change this on a running system.
V-248625	OL 8 file systems must not interpret character or block special devices that are imported via NFS.	There is no way to safely change this on a running system.
V-248807	OL 8 audit tools must have a mode of "0755" or less permissive.	There is currently no way for the product to extrapolate which audit tools are installed on the system. Since there is no way to know which tools are in use, permissions for those tools won't be controlled by the product.
V-248808	OL 8 audit tools must be owned by root.	There is currently no way for the product to extrapolate which audit tools are installed on the system. Since there is no way to know which tools are in use, permissions for those tools won't be controlled by the product.
V-248809	OL 8 audit tools must be group-owned by root.	There is currently no way for the product to extrapolate which audit tools are installed on the system. Since there is no way to know which tools are in use, permissions for those tools won't be controlled by the product.
V-248850	OL 8 must mount "/var/log" with the "nodev" option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-248851	OL 8 must mount "/var/log" with the "nosuid" option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-248852	OL 8 must mount "/var/log" with the "noexec" option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-248853	OL 8 must mount "/var/log/audit" with the "nodev" option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-248854	OL 8 must mount "/var/log/audit" with the "nosuid" option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-248855	OL 8 must mount "/var/log/audit" with the "noexec" option.	The product will not enforce specific mountpoints or their options other than tmp mounts.

RedHat 8 (17/230 [7%])

Control	Title	Notes
V-230221	RHEL 8 must be a vendor-supported release.	The product won't automatically do kernel updates, this could cause significant issues for customers who are not prepared for the kernel updates.
V-230223	RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.	The product will not enable FIPS mode on any system, if customers are prepared to turn FIPS mode on, they will need to manually enable it.
V-230232	RHEL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.	Locking a user due to inappropriate encryption is not currently available in simp. A mechanism to address this rule will be implemented in a future release.
V-230234	RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.	The product will not set any passwords for superusers.
V-230235	RHEL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.	The product will not set any passwords for superusers.
V-230238	RHEL 8 must prevent system daemons from using Kerberos for authentication.	The product will not walk the entire filesystem looking for .keytab files, it could cause problems in systems leveraging large file shares.
V-230257	RHEL 8 system commands must have mode 755 or less permissive.	The product will not walk the filesystem looking for system commands. This could cause issues on systems utilizing large file shares.
V-230258	RHEL 8 system commands must be owned by root.	The product will not walk the filesystem looking for system commands. This could cause issues on systems utilizing large file shares.
V-230259	RHEL 8 system commands must be group-owned by root or a system account.	The product will not walk the filesystem looking for system commands. This could cause issues on systems utilizing large file shares.
V-230264	RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.	The product will not configure anything within the /etc/yum.repos.d directory. It is likely customers will be configuring their own repositories and turning gpgcheck on automatically could cause loss of access to critical internal repos.
V-230301	RHEL 8 must prevent special devices on non-root local partitions.	There is no way to safely change this on a running system.
V-230307	RHEL 8 must prevent special devices on file systems that are imported via Network File System (NFS).	There is no way to safely change this on a running system.
V-230514	RHEL 8 must mount /var/log with the nodev option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-230515	RHEL 8 must mount /var/log with the nosuid option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-230516	RHEL 8 must mount /var/log with the noexec option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-230517	RHEL 8 must mount /var/log/audit with the nodev option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-230518	RHEL 8 must mount /var/log/audit with the nosuid option.	The product will not enforce specific mountpoints or their options other than tmp mounts.

RedHat 9 (49/404 [12%])

Control	Title	Notes
V-257777	RHEL 9 must be a vendor-supported release.	The product will not automatically update the kernel to the latest version as it could cause various unforeseen issues in systems that haven't tested the upgrade first.
V-257843	A separate RHEL 9 file system must be used for user home directories (such as /home or an equivalent).	There is no way to safely change this on a running system.
V-257845	RHEL 9 must use a separate file system for /var.	There is no way to safely change this on a running system.
V-257846	RHEL 9 must use a separate file system for /var/log.	There is no way to safely change this on a running system.
V-257847	RHEL 9 must use a separate file system for the system audit data path.	There is no way to safely change this on a running system.
V-257848	RHEL 9 must use a separate file system for /var/tmp.	There is no way to safely change this on a running system.
V-257850	RHEL 9 must prevent device files from being interpreted on file systems that contain user home directories.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257851	RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257852	RHEL 9 must prevent code from being executed on file systems that contain user home directories.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257854	RHEL 9 must prevent special devices on file systems that are imported via Network File System (NFS).	There is no way to safely change this on a running system.
V-257855	RHEL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS).	There is no way to safely change this on a running system.
V-257856	RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).	There is no way to safely change this on a running system.
V-257860	RHEL 9 must mount /boot with the nodev option.	There is no way to safely change this on a running system.
V-257861	RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.	There is no way to safely change this on a running system.
V-257862	RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.	There is no way to safely change this on a running system.
V-257869	RHEL 9 must mount /var with the nodev option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257870	RHEL 9 must mount /var/log with the nodev option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257871	RHEL 9 must mount /var/log with the noexec option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257872	RHEL 9 must mount /var/log with the nosuid option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257873	RHEL 9 must mount /var/log/audit with the nodev option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257874	RHEL 9 must mount /var/log/audit with the noexec option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257875	RHEL 9 must mount /var/log/audit with the nosuid option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257881	RHEL 9 must prevent special devices on non-root local partitions.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-257882	RHEL 9 system commands must have mode 755 or less permissive.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257883	RHEL 9 library directories must have mode 755 or less permissive.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257884	RHEL 9 library files must have mode 755 or less permissive.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257887	RHEL 9 audit tools must have a mode of 0755 or less permissive.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257918	RHEL 9 system commands must be owned by root.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257919	RHEL 9 system commands must be group-owned by root or a system account.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257920	RHEL 9 library files must be owned by root.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257921	RHEL 9 library files must be group-owned by root or a system account.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257922	RHEL 9 library directories must be owned by root.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257923	RHEL 9 library directories must be group-owned by root or a system account.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257924	RHEL 9 audit tools must be owned by root.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257925	RHEL 9 audit tools must be group-owned by root.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257941	RHEL 9 network interfaces must not be in promiscuous mode.	The product will not configure network interfaces automatically
V-258130	RHEL 9 must prevent system daemons from using Kerberos for authentication.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-258149	RHEL 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.	The product cannot set a specific remote logging server. The user will need to configure this manually.
V-258155	RHEL 9 must allocate audit record storage capacity to store at least one week's worth of audit records.	We cannot automate deciding how large a weeks worth of logs is. This is a manual process.
V-258230	RHEL 9 must enable FIPS mode.	Turning fips mode on in a machine that isn't already configured for it will cause connection issues to anything not configured to work in fips mode. It is more likely that the user will lose access to their systems or important services than it working out of the box.
V-258231	RHEL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.	Locking a user due to inappropriate encryption is not currently available in simp. A mechanism to address this rule will be implemented in a future release.
V-258232	RHEL 9 IP tunnels must use FIPS 140-2/140-3 approved cryptographic algorithms.	There is currently no mechanism to control the content of /etc/ipsec.conf. One may be implemented in the future.
V-258234	RHEL 9 must have the crypto-policies package installed.	Turning fips mode on in a machine that isn't already configured for it will cause connection issues to anything not configured to work in fips mode. It is more likely that the user will lose access to their systems or important services than it working out of the box.
V-258236	RHEL 9 crypto policy must not be overridden.	Turning fips mode on in a machine that isn't already configured for it will cause connection issues to anything not configured to work in fips mode. It is more likely that the user will lose access to their systems or important services than it working out of the box.
V-258237	RHEL 9 must use mechanisms meeting the requirements of applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.	Turning fips mode on in a machine that isn't already configured for it will cause connection issues to anything not configured to work in fips mode. It is more likely that the user will lose access to their systems or important services than it working out of the box.
V-258238	RHEL 9 must implement DOD-approved TLS encryption in the GnuTLS package.	Turning fips mode on in a machine that isn't already configured for it will cause connection issues to anything not configured to work in fips mode. It is more likely that the user will lose access to their systems or important services than it working out of the box.
V-258239	RHEL 9 must implement DOD-approved encryption in the OpenSSL package.	There is currently no mechanism to control the content of /etc/crypto-policies/back-ends/opensslcnf.config. One may be implemented in the future.
V-258240	RHEL 9 must implement DOD-approved TLS encryption in the OpenSSL package.	There is currently no mechanism to control the content of /etc/crypto-policies/back-ends/opensslcnf.config. One may be implemented in the future.
V-258242	RHEL 9 must implement DOD-approved encryption in the bind package.	There is currently no mechanism to control the content of /etc/named.conf. One may be implemented in the future.

---

Mapped

The following controls are mapped:

OracleLinux 8 (229/244 [93%])

Control	Title	Notes
V-248519	The OL 8 audit package must be installed.
V-248520	OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
V-248521	OL 8 must be a vendor-supported release.
V-248524	OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.	Fips mode is enabled as requested by this rule, however, the scan still fails.
V-248527	OL 8 must display a banner before granting local or remote access to the system via a graphical user logon.
V-248533	OL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.
V-248535	The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.
V-248537	OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.	The grub password will be set in /etc/grub2.conf to the password defined in simp_grub::password in hieradata
V-248540	OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.	The grub password will be set in /etc/grub2.conf to the password defined in simp_grub::password in hieradata
V-248541	OL 8 operating systems must require authentication upon booting into rescue mode.
V-248542	OL 8 operating systems must require authentication upon booting into emergency mode.
V-248543	The OL 8 "pam_unix.so" module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
V-248544	The OL 8 "pam_unix.so" module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
V-248546	The krb5-workstation package must not be installed on OL 8.
V-248547	The krb5-server package must not be installed on OL 8.
V-248549	OL 8 must have the "policycoreutils" package installed.
V-248552	OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
V-248554	The OL 8 "/var/log/messages" file must have mode 0640 or less permissive.
V-248555	The OL 8 "/var/log/messages" file must be owned by root.
V-248556	The OL 8 "/var/log/messages" file must be group-owned by root.
V-248557	The OL 8 "/var/log" directory must have mode 0755 or less permissive.
V-248558	The OL 8 "/var/log" directory must be owned by root.
V-248559	The OL 8 "/var/log" directory must be group-owned by root.
V-248563	The OL 8 SSH server must be configured to use strong entropy.
V-248574	YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization.	Enabling gpgcheck globally is as close as we can get for this check, users may require access to private repos that might not have encryption set up appropriately.
V-248575	OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.	Enabling gpgcheck globally is as close as we can get for this check, users may require access to private repos that might not have encryption set up appropriately.
V-248577	OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks.
V-248578	OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on hardlinks.
V-248579	OL 8 must restrict access to the kernel message buffer.
V-248580	OL 8 must prevent kernel profiling by unprivileged users.
V-248581	OL 8 must require users to provide a password for privilege escalation.	Enforcing this rule will only remove !authenticate from the /etc/sudoers file. Any custom files within /etc/sudoers.d will not be modified.
V-248582	OL 8 must require users to reauthenticate for privilege escalation and changing roles.	Enforcing this rule will only remove !authenticate from the /etc/sudoers file. Any custom files within /etc/sudoers.d will not be modified.
V-248583	OL 8 must restrict privilege elevation to authorized personnel.	There is currently no mechanisme in the product to remove all occurrences of 'ALL' from sudoers. A mechanism to report, but not change, the existence of this statement in sudoers will be implemented in a future release.
V-248584	OL 8 must use the invoking user's password for privilege escalation when using "sudo".	Automatically remediating this could cause some automated processes that require root access to fail. Since this will be site-specific this will not be enforced.
V-248585	OL 8 must require reauthentication when using the "sudo" command.
V-248586	OL 8 must have the package required for multifactor authentication installed.
V-248595	YUM must remove all software components after updated versions have been installed on OL 8.
V-248596	OL 8 must enable the SELinux targeted policy.
V-248597	There must be no "shosts.equiv" files on the OL 8 operating system.
V-248598	There must be no ".shosts" files on the OL 8 operating system.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-248601	The OL 8 SSH public host key files must have mode "0644" or less permissive.
V-248602	The OL 8 SSH private host key files must have mode "0640" or less permissive.	The product parses the output of 'sshd -T' for the key that the system uses for communication and ensures that key is appropriately protected. The other keys in that location may not have the correct permissions applied. https://github.com/simp/pupmod-simp-ssh/issues/150 has been created to address this issue.
V-248603	The OL 8 SSH daemon must perform strict mode checking of home directory configuration files.
V-248605	The OL 8 SSH daemon must not allow authentication using known host's authentication.
V-248606	The OL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements.
V-248607	The OL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements.
V-248608	OL 8 must use a separate file system for "/var".	There is no way to safely change this on a running system.
V-248609	OL 8 must use a separate file system for "/var/log".	There is no way to safely change this on a running system.
V-248610	OL 8 must use a separate file system for the system audit data path.	There is no way to safely change this on a running system.
V-248611	OL 8 must use a separate file system for "/tmp".	There is no way to safely change this on a running system.
V-248613	OL 8 must not permit direct logons to the root account using remote access via SSH.
V-248615	OL 8 must have the rsyslog service enabled and active.
V-248617	OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.	The product doesn't configure mountpoints due various data access issues that could happen.
V-248624	OL 8 file systems must not execute binary files that are imported via Network File System (NFS).
V-248626	OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).	The product doesn't configure mountpoints due various data access issues that could happen.
V-248629	OL 8 must disable the "kernel.core_pattern".	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-248632	OL 8 must disable storing core dumps.
V-248633	OL 8 must disable core dump backtraces.
V-248644	All OL 8 local interactive user accounts must be assigned a home directory upon creation.
V-248649	Unattended or automatic logon via the OL 8 graphical user interface must not be allowed.
V-248650	OL 8 must not allow users to override SSH environment variables.
V-248652	OL 8 systems below version 8.2 must automatically lock an account when three unsuccessful logon attempts occur.
V-248653	OL 8 systems, versions 8.2 and above, must automatically lock an account when three unsuccessful logon attempts occur.
V-248654	OL 8 systems below version 8.2 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
V-248655	OL 8 systems, versions 8.2 and above, must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
V-248656	OL 8 systems below version 8.2 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-248657	OL 8 systems, versions 8.2 and above, must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-248660	OL 8 systems below version 8.2 must prevent system messages from being presented when three unsuccessful logon attempts occur.
V-248661	OL 8 systems, versions 8.2 and above, must prevent system messages from being presented when three unsuccessful logon attempts occur.
V-248662	OL 8 systems below version 8.2 must log user name information when unsuccessful logon attempts occur.
V-248663	OL 8 systems, versions 8.2 and above, must log user name information when unsuccessful logon attempts occur.
V-248664	OL 8 systems below version 8.2 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-248665	OL 8 systems, versions 8.2 and above, must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-248666	OL 8 must limit the number of concurrent sessions to 10 for all accounts and/or account types.
V-248674	OL 8 must have the tmux package installed.	While it won't explicitly remove tmux from the list of shells, including the useradd class will remove any unapproved shells from /etc/shells, including tmux.
V-248675	OL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions.	While it won't explicitly remove tmux from the list of shells, including the useradd class will remove any unapproved shells from /etc/shells, including tmux.
V-248677	OL 8 must prevent users from disabling session control mechanisms.	While it won't explicitly remove tmux from the list of shells, including the useradd class will remove any unapproved shells from /etc/shells, including tmux.
V-248686	OL 8 must ensure the password complexity module is enabled in the password-auth file.
V-248687	OL 8 must enforce password complexity by requiring that at least one uppercase character be used.
V-248688	OL 8 must enforce password complexity by requiring that at least one lowercase character be used.
V-248689	OL 8 must enforce password complexity by requiring that at least one numeric character be used.
V-248690	OL 8 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
V-248691	OL 8 must require the maximum number of repeating characters be limited to three when passwords are changed.
V-248692	OL 8 must require the change of at least four character classes when passwords are changed.
V-248693	OL 8 must require the change of at least eight characters when passwords are changed.
V-248694	OL 8 passwords for new users or password changes must have a 24 hours/one day minimum password lifetime restriction in "/etc/shadow".	We do not currently have the ability to identify and remediate existing users who do not have this set appropriately, only new users.
V-248695	OL 8 passwords for new users or password changes must have a 24 hours/one day minimum password lifetime restriction in "/etc/login.defs".	We do not currently have the ability to identify and remediate existing users who do not have this set appropriately, only new users.
V-248696	OL 8 user account passwords must have a 60-day maximum password lifetime restriction.	We do not currently have the ability to identify and remediate existing users who do not have this set appropriately, only new users.
V-248697	OL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime.	We do not currently have the ability to identify and remediate existing users who do not have this set appropriately, only new users.
V-248699	OL 8 passwords must have a minimum of 15 characters.
V-248700	OL 8 passwords for new users must have a minimum of 15 characters.
V-248705	The OL 8 lastlog command must have a mode of "0750" or less permissive.
V-248706	The OL 8 lastlog command must be owned by root.
V-248707	The OL 8 lastlog command must be group-owned by root.
V-248709	All OL 8 passwords must contain at least one special character.
V-248710	OL 8 must prohibit the use of cached authentications after one day.
V-248711	OL 8 must prevent the use of dictionary words for passwords.
V-248712	OL 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
V-248714	OL 8 must not allow accounts configured with blank or null passwords.
V-248715	OL 8 must not allow blank or null passwords in the system-auth file.
V-248716	OL 8 must not allow blank or null passwords in the password-auth file.
V-248717	OL 8 must display the date and time of the last successful account logon upon logon.	This check will fail if there is a commented out line that looks like "#PrintLastLog = " even if the correct value of "PrintLastLog = true" exists in the /etc/ssh/sshd_config file.
V-248718	OL 8 must display the date and time of the last successful account logon upon an SSH logon.
V-248719	OL 8 default permissions must be defined in such a way that all authenticated users can read and modify only their own files.
V-248722	The OL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software.
V-248724	The OL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
V-248726	The OL 8 System must take appropriate action when an audit processing failure occurs.
V-248728	The OL 8 audit system must take appropriate action when the audit storage volume is full.
V-248729	The OL 8 audit system must audit local events.
V-248730	OL 8 must label all offloaded audit logs before sending them to the central log server.
V-248731	OL 8 must resolve audit information before writing to disk.
V-248732	OL 8 audit logs must have a mode of "0600" or less permissive to prevent unauthorized read access.
V-248733	OL 8 audit logs must be owned by root to prevent unauthorized read access.
V-248734	OL 8 audit logs must be group-owned by root to prevent unauthorized read access.
V-248735	The OL 8 audit log directory must be owned by root to prevent unauthorized read access.
V-248736	The OL 8 audit log directory must be group-owned by root to prevent unauthorized read access.
V-248737	The OL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.
V-248738	The OL 8 audit system must protect auditing rules from unauthorized change.
V-248739	The OL 8 audit system must protect logon UIDs from unauthorized change.
V-248740	OL 8 must generate audit records for all account creation events that affect "/etc/shadow".
V-248741	OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
V-248742	OL 8 must generate audit records for all account creation events that affect "/etc/passwd".
V-248743	OL 8 must generate audit records for all account creation events that affect "/etc/gshadow".
V-248744	OL 8 must generate audit records for all account creation events that affect "/etc/group".
V-248745	OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
V-248746	OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
V-248747	OL 8 must generate audit records for any use of the "su" command.
V-248748	The OL 8 audit system must be configured to audit any use of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
V-248753	OL 8 must generate audit records for any use of the "chage" command.
V-248754	OL 8 must generate audit records for any uses of the "chcon" command.
V-248756	OL 8 must generate audit records for any use of the "ssh-agent" command.
V-248757	OL 8 must generate audit records for any use of the "passwd" command.
V-248758	OL 8 must generate audit records for any use of the "mount" command.
V-248759	OL 8 must generate audit records for any use of the "umount" command.
V-248760	OL 8 must generate audit records for any use of the "mount" syscall.
V-248761	OL 8 must generate audit records for any use of the "unix_update" command.
V-248762	OL 8 must generate audit records for any use of the "postdrop" command.
V-248763	OL 8 must generate audit records for any use of the "postqueue" command.
V-248764	OL 8 must generate audit records for any use of the "semanage" command.
V-248765	OL 8 must generate audit records for any use of the "setfiles" command.
V-248766	OL 8 must generate audit records for any use of the "userhelper" command.
V-248767	OL 8 must generate audit records for any use of the "setsebool" command.
V-248768	OL 8 must generate audit records for any use of the "unix_chkpwd" command.
V-248769	OL 8 must generate audit records for any use of the "ssh-keysign" command.
V-248770	OL 8 must generate audit records for any use of the "setfacl" command.
V-248771	OL 8 must generate audit records for any use of the "pam_timestamp_check" command.
V-248772	OL 8 must generate audit records for any use of the "newgrp" command.
V-248773	OL 8 must generate audit records for any use of the "init_module" and "finit_module" system calls.
V-248774	OL 8 must generate audit records for any use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls.
V-248779	OL 8 must generate audit records for any use of the "gpasswd" command.
V-248781	OL 8 must generate audit records for any use of the delete_module syscall.
V-248782	OL 8 must generate audit records for any use of the "crontab" command.
V-248783	OL 8 must generate audit records for any use of the "chsh" command.
V-248784	OL 8 must generate audit records for any use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
V-248790	OL 8 must generate audit records for any use of the "chown", "fchown", "fchownat", and "lchown" system calls.
V-248791	OL 8 must generate audit records for any use of the "chmod", "fchmod", and "fchmodat" system calls.
V-248797	OL 8 must generate audit records for any use of the "sudo" command.
V-248798	OL 8 must generate audit records for any use of the "usermod" command.
V-248799	OL 8 must generate audit records for any use of the "chacl" command.
V-248800	OL 8 must generate audit records for any use of the "kmod" command.
V-248802	OL 8 must generate audit records for any attempted modifications to the "lastlog" file.
V-248806	OL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.	The product will set the mode of the files referenced in this rule to "700" and "600" rather then "750" and "640". This will lock down the files and keep them secure so only admins and ISSMs can access them.
V-248812	OL 8 must have the packages required for offloading audit logs installed.
V-248813	OL 8 must have the packages required for encrypting offloaded audit logs installed.
V-248815	OL 8 must take appropriate action when the internal event queue is full.
V-248818	OL 8 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
V-248821	OL 8 must disable the chrony daemon from acting as a server.
V-248822	OL 8 must disable network management of the chrony daemon.
V-248823	OL 8 must not have the telnet-server package installed.
V-248824	OL 8 must not have any automated bug reporting tools installed.
V-248825	OL 8 must not have the sendmail package installed.
V-248827	OL 8 must not have the rsh-server package installed.
V-248829	OL 8 must not have the asynchronous transfer mode (ATM) kernel module installed if not required for operational support.
V-248830	OL 8 must not have the Controller Area Network (CAN) kernel module installed if not required for operational support.
V-248831	OL 8 must not have the stream control transmission protocol (SCTP) kernel module installed if not required for operational support.
V-248832	OL 8 must disable the transparent inter-process communication (TIPC) protocol.
V-248833	OL 8 must disable mounting of cramfs.
V-248834	OL 8 must disable IEEE 1394 (FireWire) Support.
V-248837	OL 8 must be configured to disable the ability to use USB mass storage devices.
V-248840	A firewall must be installed on OL 8.
V-248841	A firewall must be active on OL 8.
V-248843	OL 8 Bluetooth must be disabled.	/etc/modprobe.d/bluetooth.conf contains the content "install bluetooth /bin/false" as requested, however, the test appears to be skipping the evaluation of this file and instead is looking for "blacklist bluetooth". Which is making the test fail.
V-248844	OL 8 must mount "/dev/shm" with the "nodev" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248845	OL 8 must mount "/dev/shm" with the "nosuid" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248846	OL 8 must mount "/dev/shm" with the "noexec" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248847	OL 8 must mount "/tmp" with the "nodev" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248848	OL 8 must mount "/tmp" with the "nosuid" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248849	OL 8 must mount "/tmp" with the "noexec" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248856	OL 8 must mount "/var/tmp" with the "nodev" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248857	OL 8 must mount "/var/tmp" with the "nosuid" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248858	OL 8 must mount "/var/tmp" with the "noexec" option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-248859	The OL 8 "fapolicy" module must be installed.
V-248862	OL 8 must have the USBGuard installed.
V-248867	All OL 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
V-248868	OL 8 must force a frequent session key renegotiation for SSH connections to the server.
V-248870	The x86 Ctrl-Alt-Delete key sequence in OL 8 must be disabled if a graphical user interface is installed.
V-248871	OL 8 must disable the systemd Ctrl-Alt-Delete burst key sequence.
V-248873	The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for OL 8 operational support.
V-248874	The root account must be the only account having unrestricted access to the OL 8 system.
V-248875	OL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
V-248876	OL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
V-248877	OL 8 must not send Internet Control Message Protocol (ICMP) redirects.
V-248878	OL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
V-248879	OL 8 must not forward IPv4 source-routed packets.
V-248880	OL 8 must not forward IPv6 source-routed packets.
V-248881	OL 8 must not forward IPv4 source-routed packets by default.
V-248882	OL 8 must not forward IPv6 source-routed packets by default.
V-248883	OL 8 must not enable IPv6 packet forwarding unless the system is a router.
V-248884	OL 8 must not accept router advertisements on all IPv6 interfaces.
V-248885	OL 8 must not accept router advertisements on all IPv6 interfaces by default.
V-248886	OL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
V-248887	OL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages.
V-248888	OL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
V-248889	OL 8 must disable access to the network "bpf" syscall from unprivileged processes.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-248890	OL 8 must restrict the use of "ptrace" to descendant processes.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-248891	OL 8 must restrict exposed kernel pointer addresses access.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-248892	OL 8 must disable the use of user namespaces.
V-248893	OL 8 must use reverse path filtering on all IPv4 interfaces.
V-248894	OL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler.
V-248895	OL 8 must be configured to prevent unrestricted mail relaying.
V-248900	OL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements.
V-248901	The OL 8 SSH daemon must prevent remote hosts from connecting to the proxy display.	The UsePrivilegeSeparation ssh server config option was deprecated in openssh version 7.4 the product won't use this parameter unless the openssh version is less than 7.4.
V-248902	If the Trivial File Transfer Protocol (TFTP) server is required, the OL 8 TFTP daemon must be configured to operate in secure mode.
V-248903	A File Transfer Protocol (FTP) server package must not be installed unless mission essential on OL 8.
V-248904	OL 8 must not have the "gssproxy" package installed if not required for operational support.
V-248905	OL 8 must not have the "iprutils" package installed if not required for operational support.
V-248906	OL 8 must not have the "tuned" package installed if not required for operational support.
V-252658	OL 8 systems below version 8.4 must ensure the password complexity module in the system-auth file is configured for three retries or less.
V-257259	OL 8 must terminate idle user sessions.

RedHat 8 (213/230 [92%])

Control	Title	Notes
V-230231	RHEL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.
V-230233	The RHEL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.
V-230236	RHEL 8 operating systems must require authentication upon booting into rescue mode.
V-230237	The RHEL 8 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
V-230239	The krb5-workstation package must not be installed on RHEL 8.
V-230241	RHEL 8 must have policycoreutils package installed.
V-230244	RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
V-230245	The RHEL 8 /var/log/messages file must have mode 0640 or less permissive.
V-230246	The RHEL 8 /var/log/messages file must be owned by root.
V-230247	The RHEL 8 /var/log/messages file must be group-owned by root.
V-230248	The RHEL 8 /var/log directory must have mode 0755 or less permissive.
V-230249	The RHEL 8 /var/log directory must be owned by root.
V-230250	The RHEL 8 /var/log directory must be group-owned by root.
V-230253	RHEL 8 must ensure the SSH server uses strong entropy.
V-230255	The RHEL 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package.
V-230265	RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
V-230266	RHEL 8 must prevent the loading of a new kernel for later execution.
V-230267	RHEL 8 must enable kernel parameters to enforce discretionary access control on symlinks.
V-230268	RHEL 8 must enable kernel parameters to enforce discretionary access control on hardlinks.
V-230269	RHEL 8 must restrict access to the kernel message buffer.
V-230270	RHEL 8 must prevent kernel profiling by unprivileged users.
V-230271	RHEL 8 must require users to provide a password for privilege escalation.	Enforcing this rule will only remove !authenticate from the /etc/sudoers file. Any custom files within /etc/sudoers.d will not be modified.
V-230272	RHEL 8 must require users to reauthenticate for privilege escalation.	Enforcing this rule will only remove !authenticate from the /etc/sudoers file. Any custom files within /etc/sudoers.d will not be modified.
V-230273	RHEL 8 must have the packages required for multifactor authentication installed.
V-230280	RHEL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
V-230281	YUM must remove all software components after updated versions have been installed on RHEL 8.
V-230282	RHEL 8 must enable the SELinux targeted policy.
V-230283	There must be no shosts.equiv files on the RHEL 8 operating system.
V-230284	There must be no .shosts files on the RHEL 8 operating system.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-230286	The RHEL 8 SSH public host key files must have mode 0644 or less permissive.
V-230287	The RHEL 8 SSH private host key files must have mode 0640 or less permissive.	The product parses the output of 'sshd -T' for the key that the system uses for communication and ensures that key is appropriately protected. The other keys in that location may not have the correct permissions applied. https://github.com/simp/pupmod-simp-ssh/issues/150 has been created to address this issue.
V-230288	The RHEL 8 SSH daemon must perform strict mode checking of home directory configuration files.
V-230290	The RHEL 8 SSH daemon must not allow authentication using known host’s authentication.
V-230291	The RHEL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements.
V-230292	RHEL 8 must use a separate file system for /var.	There is no way to safely change this on a running system.
V-230293	RHEL 8 must use a separate file system for /var/log.	There is no way to safely change this on a running system.
V-230294	RHEL 8 must use a separate file system for the system audit data path.	There is no way to safely change this on a running system.
V-230295	A separate RHEL 8 filesystem must be used for the /tmp directory.	There is no way to safely change this on a running system.
V-230296	RHEL 8 must not permit direct logons to the root account using remote access via SSH.
V-230298	The rsyslog service must be running in RHEL 8.
V-230300	RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.	The product doesn't configure mountpoints due various data access issues that could happen.
V-230306	RHEL 8 must prevent code from being executed on file systems that are imported via Network File System (NFS).
V-230308	RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).	The product doesn't configure mountpoints due various data access issues that could happen.
V-230311	RHEL 8 must disable the kernel.core_pattern.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-230313	RHEL 8 must disable core dumps for all users.
V-230314	RHEL 8 must disable storing core dumps.
V-230315	RHEL 8 must disable core dump backtraces.
V-230324	All RHEL 8 local interactive user accounts must be assigned a home directory upon creation.
V-230330	RHEL 8 must not allow users to override SSH environment variables.
V-230332	RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur.
V-230333	RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur.
V-230334	RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
V-230335	RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
V-230336	RHEL 8 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-230337	RHEL 8 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-230340	RHEL 8 must prevent system messages from being presented when three unsuccessful logon attempts occur.
V-230341	RHEL 8 must prevent system messages from being presented when three unsuccessful logon attempts occur.
V-230342	RHEL 8 must log user name information when unsuccessful logon attempts occur.
V-230343	RHEL 8 must log user name information when unsuccessful logon attempts occur.
V-230344	RHEL 8 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-230345	RHEL 8 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-230346	RHEL 8 must limit the number of concurrent sessions to ten for all accounts and/or account types.
V-230356	RHEL 8 must ensure the password complexity module is enabled in the password-auth file.
V-230357	RHEL 8 must enforce password complexity by requiring that at least one uppercase character be used.
V-230358	RHEL 8 must enforce password complexity by requiring that at least one lower-case character be used.
V-230359	RHEL 8 must enforce password complexity by requiring that at least one numeric character be used.
V-230360	RHEL 8 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
V-230361	RHEL 8 must require the maximum number of repeating characters be limited to three when passwords are changed.
V-230362	RHEL 8 must require the change of at least four character classes when passwords are changed.
V-230363	RHEL 8 must require the change of at least 8 characters when passwords are changed.
V-230364	RHEL 8 passwords must have a 24 hours/1 day minimum password lifetime restriction in /etc/shadow.	We do not currently have the ability to identify and remediate existing users who do not have this set appropriately, only new users.
V-230365	RHEL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in /etc/login.defs.	We do not currently have the ability to identify and remediate existing users who do not have this set appropriately, only new users.
V-230366	RHEL 8 user account passwords must have a 60-day maximum password lifetime restriction.
V-230367	RHEL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime.
V-230369	RHEL 8 passwords must have a minimum of 15 characters.
V-230370	RHEL 8 passwords for new users must have a minimum of 15 characters.
V-230373	RHEL 8 account identifiers (individuals, groups, roles, and devices) must be disabled after 35 days of inactivity.
V-230375	All RHEL 8 passwords must contain at least one special character.
V-230376	RHEL 8 must prohibit the use of cached authentications after one day.
V-230377	RHEL 8 must prevent the use of dictionary words for passwords.
V-230378	RHEL 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
V-230380	RHEL 8 must not allow accounts configured with blank or null passwords.
V-230381	RHEL 8 must display the date and time of the last successful account logon upon logon.	This check will fail if there is a commented out line that looks like "#PrintLastLog = " even if the correct value of "PrintLastLog = true" exists in the /etc/ssh/sshd_config file.
V-230382	RHEL 8 must display the date and time of the last successful account logon upon an SSH logon.
V-230383	RHEL 8 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
V-230386	The RHEL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software.
V-230388	The RHEL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
V-230390	The RHEL 8 System must take appropriate action when an audit processing failure occurs.
V-230392	The RHEL 8 audit system must take appropriate action when the audit storage volume is full.
V-230393	The RHEL 8 audit system must audit local events.
V-230394	RHEL 8 must label all off-loaded audit logs before sending them to the central log server.
V-230395	RHEL 8 must resolve audit information before writing to disk.
V-230396	RHEL 8 audit logs must have a mode of 0600 or less permissive to prevent unauthorized read access.
V-230397	RHEL 8 audit logs must be owned by root to prevent unauthorized read access.
V-230398	RHEL 8 audit logs must be group-owned by root to prevent unauthorized read access.
V-230399	RHEL 8 audit log directory must be owned by root to prevent unauthorized read access.
V-230400	RHEL 8 audit log directory must be group-owned by root to prevent unauthorized read access.
V-230401	RHEL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.
V-230402	RHEL 8 audit system must protect auditing rules from unauthorized change.
V-230403	RHEL 8 audit system must protect logon UIDs from unauthorized change.
V-230404	RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
V-230405	RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
V-230406	RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
V-230407	RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
V-230408	RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
V-230409	RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
V-230410	RHEL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/.
V-230411	The RHEL 8 audit package must be installed.
V-230412	Successful/unsuccessful uses of the su command in RHEL 8 must generate an audit record.
V-230413	The RHEL 8 audit system must be configured to audit any usage of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
V-230418	Successful/unsuccessful uses of the chage command in RHEL 8 must generate an audit record.
V-230419	Successful/unsuccessful uses of the chcon command in RHEL 8 must generate an audit record.
V-230421	Successful/unsuccessful uses of the ssh-agent in RHEL 8 must generate an audit record.
V-230422	Successful/unsuccessful uses of the passwd command in RHEL 8 must generate an audit record.
V-230423	Successful/unsuccessful uses of the mount command in RHEL 8 must generate an audit record.
V-230424	Successful/unsuccessful uses of the umount command in RHEL 8 must generate an audit record.
V-230425	Successful/unsuccessful uses of the mount syscall in RHEL 8 must generate an audit record.
V-230426	Successful/unsuccessful uses of the unix_update in RHEL 8 must generate an audit record.
V-230427	Successful/unsuccessful uses of postdrop in RHEL 8 must generate an audit record.
V-230428	Successful/unsuccessful uses of postqueue in RHEL 8 must generate an audit record.
V-230429	Successful/unsuccessful uses of semanage in RHEL 8 must generate an audit record.
V-230430	Successful/unsuccessful uses of setfiles in RHEL 8 must generate an audit record.
V-230431	Successful/unsuccessful uses of userhelper in RHEL 8 must generate an audit record.
V-230432	Successful/unsuccessful uses of setsebool in RHEL 8 must generate an audit record.
V-230433	Successful/unsuccessful uses of unix_chkpwd in RHEL 8 must generate an audit record.
V-230434	Successful/unsuccessful uses of the ssh-keysign in RHEL 8 must generate an audit record.
V-230435	Successful/unsuccessful uses of the setfacl command in RHEL 8 must generate an audit record.
V-230436	Successful/unsuccessful uses of the pam_timestamp_check command in RHEL 8 must generate an audit record.
V-230437	Successful/unsuccessful uses of the newgrp command in RHEL 8 must generate an audit record.
V-230438	Successful/unsuccessful uses of the init_module and finit_module system calls in RHEL 8 must generate an audit record.
V-230439	Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in RHEL 8 must generate an audit record.
V-230444	Successful/unsuccessful uses of the gpasswd command in RHEL 8 must generate an audit record.
V-230446	Successful/unsuccessful uses of the delete_module command in RHEL 8 must generate an audit record.
V-230447	Successful/unsuccessful uses of the crontab command in RHEL 8 must generate an audit record.
V-230448	Successful/unsuccessful uses of the chsh command in RHEL 8 must generate an audit record.
V-230449	Successful/unsuccessful uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls in RHEL 8 must generate an audit record.
V-230455	Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in RHEL 8 must generate an audit record.
V-230456	Successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls in RHEL 8 must generate an audit record.
V-230462	Successful/unsuccessful uses of the sudo command in RHEL 8 must generate an audit record.
V-230463	Successful/unsuccessful uses of the usermod command in RHEL 8 must generate an audit record.
V-230464	Successful/unsuccessful uses of the chacl command in RHEL 8 must generate an audit record.
V-230465	Successful/unsuccessful uses of the kmod command in RHEL 8 must generate an audit record.
V-230467	Successful/unsuccessful modifications to the lastlog file in RHEL 8 must generate an audit record.
V-230471	RHEL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.	The product will set the mode of the files referenced in this rule to "700" and "600" rather then "750" and "640". This will lock down the files and keep them secure so only admins and ISSMs can access them.
V-230472	RHEL 8 audit tools must have a mode of 0755 or less permissive.
V-230473	RHEL 8 audit tools must be owned by root.
V-230474	RHEL 8 audit tools must be group-owned by root.
V-230477	RHEL 8 must have the packages required for offloading audit logs installed.
V-230478	RHEL 8 must have the packages required for encrypting offloaded audit logs installed.
V-230480	RHEL 8 must take appropriate action when the internal event queue is full.
V-230483	RHEL 8 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
V-230485	RHEL 8 must disable the chrony daemon from acting as a server.
V-230486	RHEL 8 must disable network management of the chrony daemon.
V-230487	RHEL 8 must not have the telnet-server package installed.
V-230488	RHEL 8 must not have any automated bug reporting tools installed.
V-230489	RHEL 8 must not have the sendmail package installed.
V-230492	RHEL 8 must not have the rsh-server package installed.
V-230494	RHEL 8 must disable the asynchronous transfer mode (ATM) protocol.
V-230495	RHEL 8 must disable the controller area network (CAN) protocol.
V-230496	RHEL 8 must disable the stream control transmission protocol (SCTP).
V-230497	RHEL 8 must disable the transparent inter-process communication (TIPC) protocol.
V-230498	RHEL 8 must disable mounting of cramfs.
V-230499	RHEL 8 must disable IEEE 1394 (FireWire) Support.
V-230503	RHEL 8 must be configured to disable USB mass storage.
V-230507	RHEL 8 Bluetooth must be disabled.
V-230508	RHEL 8 must mount /dev/shm with the nodev option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230509	RHEL 8 must mount /dev/shm with the nosuid option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230510	RHEL 8 must mount /dev/shm with the noexec option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230511	RHEL 8 must mount /tmp with the nodev option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230512	RHEL 8 must mount /tmp with the nosuid option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230513	RHEL 8 must mount /tmp with the noexec option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230519	RHEL 8 must mount /var/log/audit with the noexec option.	The product will not enforce specific mountpoints or their options other than tmp mounts.
V-230520	RHEL 8 must mount /var/tmp with the nodev option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230521	RHEL 8 must mount /var/tmp with the nosuid option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230522	RHEL 8 must mount /var/tmp with the noexec option.	The product will control tmp via a bind mount. The scan will fail because it expects tmp to be configured in /etc/fstab.
V-230526	All RHEL 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
V-230527	RHEL 8 must force a frequent session key renegotiation for SSH connections to the server.
V-230531	The systemd Ctrl-Alt-Delete burst key sequence in RHEL 8 must be disabled.
V-230533	The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for RHEL 8 operational support.
V-230534	The root account must be the only account having unrestricted access to the RHEL 8 system.
V-230535	RHEL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
V-230536	RHEL 8 must not send Internet Control Message Protocol (ICMP) redirects.
V-230537	RHEL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
V-230538	RHEL 8 must not forward IPv6 source-routed packets.
V-230539	RHEL 8 must not forward IPv6 source-routed packets by default.
V-230540	RHEL 8 must not enable IPv6 packet forwarding unless the system is a router.
V-230541	RHEL 8 must not accept router advertisements on all IPv6 interfaces.
V-230542	RHEL 8 must not accept router advertisements on all IPv6 interfaces by default.
V-230543	RHEL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
V-230544	RHEL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
V-230545	RHEL 8 must disable access to network bpf syscall from unprivileged processes.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-230546	RHEL 8 must restrict usage of ptrace to descendant processes.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-230547	RHEL 8 must restrict exposed kernel pointer addresses access.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-230548	RHEL 8 must disable the use of user namespaces.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-230549	RHEL 8 must use reverse path filtering on all IPv4 interfaces.	The kernel.yama.ptrace_scope sysctl setting is set to 1 in /etc/sysctl.conf and /etc/sysctl.d/99-sysctl.conf, however, the test is failing still.
V-230550	RHEL 8 must be configured to prevent unrestricted mail relaying.
V-230555	RHEL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements.
V-230556	The RHEL 8 SSH daemon must prevent remote hosts from connecting to the proxy display.
V-230557	If the Trivial File Transfer Protocol (TFTP) server is required, the RHEL 8 TFTP daemon must be configured to operate in secure mode.
V-230558	A File Transfer Protocol (FTP) server package must not be installed unless mission essential on RHEL 8.
V-230559	The gssproxy package must not be installed unless mission essential on RHEL 8.
V-230560	The iprutils package must not be installed unless mission essential on RHEL 8.
V-230561	The tuned package must not be installed unless mission essential on RHEL 8.
V-237640	The krb5-server package must not be installed on RHEL 8.
V-237641	RHEL 8 must restrict privilege elevation to authorized personnel.	There is currently no mechanisme in the product to remove all occurrences of 'ALL' from sudoers. A mechanism to report, but not change, the existence of this statement in sudoers will be implemented in a future release.
V-237642	RHEL 8 must use the invoking user's password for privilege escalation when using "sudo".	Automatically remediating this could cause some automated processes that require root access to fail. Since this will be site-specific this will not be enforced.
V-237643	RHEL 8 must require re-authentication when using the "sudo" command.
V-244524	The RHEL 8 pam_unix.so module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
V-244541	RHEL 8 must not allow blank or null passwords in the password-auth file.
V-244554	RHEL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler.
V-251706	The RHEL 8 operating system must not have accounts configured with blank or null passwords.
V-251714	RHEL 8 systems below version 8.4 must ensure the password complexity module in the system-auth file is configured for three retries or less.
V-257258	RHEL 8.7 and higher must terminate idle user sessions.

RedHat 9 (355/404 [87%])

Control	Title	Notes
V-257781	The graphical display manager must not be the default target on RHEL 9 unless approved.
V-257782	RHEL 9 must enable the hardware random number generator entropy gatherer service.
V-257783	RHEL 9 systemd-journald service must be enabled.
V-257784	The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.
V-257785	The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.
V-257786	RHEL 9 debug-shell systemd service must be disabled.
V-257787	RHEL 9 must require a boot loader superuser password.	The grub password is set via the password_pbkdf2 parameter, however, the rule explicitly checks for GRUB2_PASSWORD. The grub username and password are being set which meets the requirement of the rule, but the check for the rule is not checking for all possible methods of setting a password for a user.
V-257788	RHEL 9 must disable the ability of systemd to spawn an interactive boot process.	If the parameter is missing from any entries in /boot/loader/entries, the test will fail. The product will not modify /boot/loader/entries unless the OS version is 9.3 or higher.
V-257790	RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root.
V-257791	RHEL 9 /boot/grub2/grub.cfg file must be owned by root.
V-257792	RHEL 9 must disable virtual system calls.	If the parameter is missing from any entries in /boot/loader/entries, the test will fail. The product will not modify /boot/loader/entries unless the OS version is 9.3 or higher.
V-257793	RHEL 9 must clear the page allocator to prevent use-after-free attacks.	If the parameter is missing from any entries in /boot/loader/entries, the test will fail. The product will not modify /boot/loader/entries unless the OS version is 9.3 or higher.
V-257794	RHEL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.	If the parameter is missing from any entries in /boot/loader/entries, the test will fail. The product will not modify /boot/loader/entries unless the OS version is 9.3 or higher.
V-257795	RHEL 9 must enable mitigations against processor-based vulnerabilities.	If the parameter is missing from any entries in /boot/loader/entries, the test will fail. The product will not modify /boot/loader/entries unless the OS version is 9.3 or higher.
V-257796	RHEL 9 must enable auditing of processes that start prior to the audit daemon.	If the parameter is missing from any entries in /boot/loader/entries, the test will fail. The product will not modify /boot/loader/entries unless the OS version is 9.3 or higher.
V-257797	RHEL 9 must restrict access to the kernel message buffer.
V-257798	RHEL 9 must prevent kernel profiling by nonprivileged users.
V-257799	RHEL 9 must prevent the loading of a new kernel for later execution.
V-257800	RHEL 9 must restrict exposed kernel pointer addresses access.
V-257801	RHEL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.
V-257802	RHEL 9 must enable kernel parameters to enforce discretionary access control on symlinks.
V-257803	RHEL 9 must disable the kernel.core_pattern.
V-257804	RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module.
V-257805	RHEL 9 must be configured to disable the Controller Area Network kernel module.
V-257806	RHEL 9 must be configured to disable the FireWire kernel module.
V-257807	RHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
V-257808	RHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.
V-257809	RHEL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
V-257810	RHEL 9 must disable access to network bpf system call from nonprivileged processes.
V-257811	RHEL 9 must restrict usage of ptrace to descendant processes.
V-257812	RHEL 9 must disable core dump backtraces.
V-257813	RHEL 9 must disable storing core dumps.
V-257814	RHEL 9 must disable core dumps for all users.
V-257815	RHEL 9 must disable acquiring, saving, and processing core dumps.
V-257816	RHEL 9 must disable the use of user namespaces.
V-257818	The kdump service on RHEL 9 must be disabled.
V-257820	RHEL 9 must check the GPG signature of software packages originating from external software repositories before installation.
V-257821	RHEL 9 must check the GPG signature of locally installed software packages before installation.
V-257822	RHEL 9 must have GPG signature verification enabled for all software repositories.
V-257824	RHEL 9 must remove all software components after updated versions have been installed.
V-257825	RHEL 9 subscription-manager package must be installed.
V-257826	RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.
V-257827	RHEL 9 must not have the sendmail package installed.
V-257828	RHEL 9 must not have the nfs-utils package installed.
V-257829	RHEL 9 must not have the ypserv package installed.
V-257830	RHEL 9 must not have the rsh-server package installed.
V-257831	RHEL 9 must not have the telnet-server package installed.
V-257832	RHEL 9 must not have the gssproxy package installed.
V-257833	RHEL 9 must not have the iprutils package installed.
V-257834	RHEL 9 must not have the tuned package installed.
V-257835	RHEL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.
V-257836	RHEL 9 must not have the quagga package installed.
V-257837	A graphical display manager must not be installed on RHEL 9 unless approved.
V-257838	RHEL 9 must have the openssl-pkcs11 package installed.	This is getting set in the /etc/sssd/conf.d/50_puppet_service_pam.conf file, while the check is looking in /etc/sssd/sssd.conf. The check should be updated to look in the correct file.
V-257839	RHEL 9 must have the gnutls-utils package installed.
V-257840	RHEL 9 must have the nss-tools package installed.
V-257841	RHEL 9 must have the rng-tools package installed.
V-257842	RHEL 9 must have the s-nail package installed.
V-257844	RHEL 9 must use a separate file system for /tmp.
V-257849	RHEL 9 file system automount function must be disabled unless required.
V-257863	RHEL 9 must mount /dev/shm with the nodev option.
V-257864	RHEL 9 must mount /dev/shm with the noexec option.
V-257865	RHEL 9 must mount /dev/shm with the nosuid option.
V-257866	RHEL 9 must mount /tmp with the nodev option.
V-257867	RHEL 9 must mount /tmp with the noexec option.
V-257868	RHEL 9 must mount /tmp with the nosuid option.
V-257876	RHEL 9 must mount /var/tmp with the nodev option.
V-257877	RHEL 9 must mount /var/tmp with the noexec option.
V-257878	RHEL 9 must mount /var/tmp with the nosuid option.
V-257880	RHEL 9 must disable mounting of cramfs.
V-257885	RHEL 9 /var/log directory must have mode 0755 or less permissive.
V-257886	RHEL 9 /var/log/messages file must have mode 0640 or less permissive.
V-257888	RHEL 9 cron configuration directories must have a mode of 0700 or less permissive.
V-257889	All RHEL 9 local initialization files must have mode 0740 or less permissive.
V-257890	All RHEL 9 local interactive user home directories must have mode 0750 or less permissive.
V-257891	RHEL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.
V-257892	RHEL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.
V-257893	RHEL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.
V-257894	RHEL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.
V-257895	RHEL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.
V-257896	RHEL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.
V-257897	RHEL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.
V-257898	RHEL 9 /etc/group file must be owned by root.
V-257899	RHEL 9 /etc/group file must be group-owned by root.
V-257900	RHEL 9 /etc/group- file must be owned by root.
V-257901	RHEL 9 /etc/group- file must be group-owned by root.
V-257902	RHEL 9 /etc/gshadow file must be owned by root.
V-257903	RHEL 9 /etc/gshadow file must be group-owned by root.
V-257904	RHEL 9 /etc/gshadow- file must be owned by root.
V-257905	RHEL 9 /etc/gshadow- file must be group-owned by root.
V-257906	RHEL 9 /etc/passwd file must be owned by root.
V-257907	RHEL 9 /etc/passwd file must be group-owned by root.
V-257908	RHEL 9 /etc/passwd- file must be owned by root.
V-257909	RHEL 9 /etc/passwd- file must be group-owned by root.
V-257910	RHEL 9 /etc/shadow file must be owned by root.
V-257911	RHEL 9 /etc/shadow file must be group-owned by root.
V-257912	RHEL 9 /etc/shadow- file must be owned by root.
V-257913	RHEL 9 /etc/shadow- file must be group-owned by root.
V-257914	RHEL 9 /var/log directory must be owned by root.
V-257915	RHEL 9 /var/log directory must be group-owned by root.
V-257916	RHEL 9 /var/log/messages file must be owned by root.
V-257917	RHEL 9 /var/log/messages file must be group-owned by root.
V-257926	RHEL 9 cron configuration files directory must be owned by root.
V-257927	RHEL 9 cron configuration files directory must be group-owned by root.
V-257933	RHEL 9 /etc/crontab file must have mode 0600.
V-257934	RHEL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.
V-257935	RHEL 9 must have the firewalld package installed.
V-257936	The firewalld service on RHEL 9 must be active.
V-257939	RHEL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.
V-257942	RHEL 9 must enable hardening for the Berkeley Packet Filter just-in-time compiler.
V-257943	RHEL 9 must have the chrony package installed.
V-257944	RHEL 9 chronyd service must be enabled.
V-257946	RHEL 9 must disable the chrony daemon from acting as a server.
V-257947	RHEL 9 must disable network management of the chrony daemon.
V-257948	RHEL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured.	The product will warn users if they don't have the minimum number of servers configured, but it cannot determine which dns servers to configure on its own.
V-257949	RHEL 9 must configure a DNS processing mode in Network Manager.
V-257951	RHEL 9 must be configured to prevent unrestricted mail relaying.
V-257953	RHEL 9 must forward mail from postmaster to the root account using a postfix alias.
V-257954	RHEL 9 libreswan package must be installed.
V-257955	There must be no shosts.equiv files on RHEL 9.
V-257956	There must be no .shosts files on RHEL 9.	We do not currently have a mechanism for scanning the filesystem for enforcement.
V-257957	RHEL 9 must be configured to use TCP syncookies.
V-257958	RHEL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.
V-257959	RHEL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
V-257960	RHEL 9 must log IPv4 packets with impossible addresses.
V-257961	RHEL 9 must log IPv4 packets with impossible addresses by default.
V-257962	RHEL 9 must use reverse path filtering on all IPv4 interfaces.
V-257963	RHEL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
V-257964	RHEL 9 must not forward IPv4 source-routed packets by default.
V-257965	RHEL 9 must use a reverse-path filter for IPv4 network traffic when possible by default.
V-257966	RHEL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
V-257967	RHEL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.
V-257968	RHEL 9 must not send Internet Control Message Protocol (ICMP) redirects.
V-257969	RHEL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
V-257970	RHEL 9 must not enable IPv4 packet forwarding unless the system is a router.
V-257971	RHEL 9 must not accept router advertisements on all IPv6 interfaces.
V-257972	RHEL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
V-257973	RHEL 9 must not forward IPv6 source-routed packets.
V-257974	RHEL 9 must not enable IPv6 packet forwarding unless the system is a router.
V-257975	RHEL 9 must not accept router advertisements on all IPv6 interfaces by default.
V-257976	RHEL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
V-257977	RHEL 9 must not forward IPv6 source-routed packets by default.
V-257978	All RHEL 9 networked systems must have SSH installed.
V-257979	All RHEL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
V-257980	RHEL 9 must have the openssh-clients package installed.
V-257981	RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a SSH logon.
V-257982	RHEL 9 must log SSH connection attempts and failures to the server.
V-257983	RHEL 9 SSHD must accept public key authentication.
V-257984	RHEL 9 SSHD must not allow blank passwords.
V-257985	RHEL 9 must not permit direct logons to the root account using remote access via SSH.
V-257986	RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
V-257987	RHEL 9 SSH daemon must be configured to use system-wide crypto policies.
V-257988	RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH client connections.	This check is incorrectly checking /etc/crypto-policies/back-ends/openssh.config for the values when it should be checking /etc/crypto-policies/back-ends/opensshserver.config. The values being requested by the rule are set in the server file instead of conflicting with the client values being requested in another rule in the openssh.config file.
V-257989	RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH server connections.	This check is incorrectly checking /etc/crypto-policies/back-ends/openssh.config for the values when it should be checking /etc/crypto-policies/back-ends/opensshserver.config. The values being requested by the rule are set in the server file instead of conflicting with the client values being requested in another rule in the openssh.config file.
V-257991	RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.	This check is incorrectly checking /etc/crypto-policies/back-ends/openssh.config for the values when it should be checking /etc/crypto-policies/back-ends/opensshserver.config. The values being requested by the rule are set in the server file instead of conflicting with the client values being requested in another rule in the openssh.config file.
V-257992	RHEL 9 must not allow a noncertificate trusted host SSH logon to the system.
V-257993	RHEL 9 must not allow users to override SSH environment variables.
V-257994	RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.
V-257995	RHEL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
V-257996	RHEL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
V-257997	RHEL 9 SSH server configuration file must be group-owned by root.
V-257998	RHEL 9 SSH server configuration file must be owned by root.
V-257999	RHEL 9 SSH server configuration file must have mode 0600 or less permissive.
V-258000	RHEL 9 SSH private host key files must have mode 0640 or less permissive.	The product parses the output of 'sshd -T' for the key that the system uses for communication and ensures that key is appropriately protected. The other keys in that location may not have the correct permissions applied. https://github.com/simp/pupmod-simp-ssh/issues/150 has been created to address this issue.
V-258001	RHEL 9 SSH public host key files must have mode 0644 or less permissive.
V-258002	RHEL 9 SSH daemon must not allow compression or must only allow compression after successful authentication.
V-258003	RHEL 9 SSH daemon must not allow GSSAPI authentication.
V-258004	RHEL 9 SSH daemon must not allow Kerberos authentication.
V-258005	RHEL 9 SSH daemon must not allow rhosts authentication.
V-258006	RHEL 9 SSH daemon must not allow known hosts authentication.
V-258007	RHEL 9 SSH daemon must disable remote X connections for interactive users.	The UsePrivilegeSeparation ssh server config option was deprecated in openssh version 7.4 the product won't use this parameter unless the openssh version is less than 7.4.
V-258008	RHEL 9 SSH daemon must perform strict mode checking of home directory configuration files.
V-258009	RHEL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.
V-258011	RHEL 9 SSH daemon must prevent remote hosts from connecting to the proxy display.	The UsePrivilegeSeparation ssh server config option was deprecated in openssh version 7.4 the product won't use this parameter unless the openssh version is less than 7.4.
V-258013	RHEL 9 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.
V-258014	RHEL 9 must disable the graphical user interface automount function unless required.
V-258015	RHEL 9 must prevent a user from overriding the disabling of the graphical user interface automount function.
V-258017	RHEL 9 must prevent a user from overriding the disabling of the graphical user interface autorun function.
V-258018	RHEL 9 must not allow unattended or automatic logon via the graphical user interface.
V-258019	RHEL 9 must be able to initiate directly a session lock for all connection types using smart card when the smart card is removed.
V-258020	RHEL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.
V-258021	RHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions.
V-258022	RHEL 9 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
V-258023	RHEL 9 must automatically lock graphical user sessions after 15 minutes of inactivity.
V-258024	RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
V-258026	RHEL 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
V-258027	RHEL 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
V-258029	RHEL 9 must disable the ability of a user to restart the system from the login screen.
V-258030	RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
V-258032	RHEL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.
V-258033	RHEL 9 must disable the user list at logon for graphical user interfaces.
V-258034	RHEL 9 must be configured to disable USB mass storage.
V-258035	RHEL 9 must have the USBGuard package installed.
V-258036	RHEL 9 must have the USBGuard package enabled.
V-258037	RHEL 9 must enable Linux audit logging for the USBGuard daemon.
V-258039	RHEL 9 Bluetooth must be disabled.
V-258041	RHEL 9 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.
V-258042	RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.	The product will cannot enforce this on existing user's passwords, only new ones that are created from the time of remediation.
V-258043	All RHEL 9 local interactive user accounts must be assigned a home directory upon creation.
V-258045	RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.
V-258046	RHEL 9 system accounts must not have an interactive login shell.	All system accounts found will be set to nologin except for the following: - root - sync - shutdown - halt The rule checks at least one of these accounts and flags it as a failure, which is a false negative. It is specifically failing because of the halt and sync accounts. Remediating these accounts could cause loss of access to the system or unexpected system failures.
V-258048	All RHEL 9 interactive users must have a primary group that exists.
V-258049	RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
V-258051	All RHEL 9 local interactive users must have a home directory assigned in the /etc/passwd file.
V-258054	RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur.
V-258055	RHEL 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-258056	RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
V-258057	RHEL 9 must maintain an account lock until the locked account is released by an administrator.
V-258059	The root account must be the only account having unrestricted access to RHEL 9 system.
V-258060	RHEL 9 must ensure account lockouts persist.
V-258061	RHEL 9 groups must have unique Group ID (GID).
V-258068	RHEL 9 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.	We set the TMOUT environment variable as requested by the rule, however, it is not in the exact format being checked so the test will fail.
V-258069	RHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.
V-258070	RHEL 9 must log username information when unsuccessful logon attempts occur.
V-258071	RHEL 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
V-258072	RHEL 9 must define default permissions for the bash shell.	There is no reliable way to remove extraneous umask commands without causing other errors. However, the umask that the product sets should take precedence over any others in the file since it will be located at the bottom.
V-258073	RHEL 9 must define default permissions for the c shell.	There is no reliable way to remove extraneous umask commands without causing other errors. However, the umask that the product sets should take precedence over any others in the file since it will be located at the bottom.
V-258074	RHEL 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
V-258075	RHEL 9 must define default permissions for the system default profile.	There is no reliable way to remove extraneous umask commands without causing other errors. However, the umask that the product sets should take precedence over any others in the file since it will be located at the bottom.
V-258076	RHEL 9 must display the date and time of the last successful account logon upon logon.	The last login will be displayed as requested, however, the remediation didn't happen in the spot that the rule is checking so this will be a false negative. The lastlogin time will be configured in login_defs.
V-258077	RHEL 9 must terminate idle user sessions.
V-258078	RHEL 9 must use a Linux Security Module configured to enforce limits on system services.
V-258079	RHEL 9 must enable the SELinux targeted policy.
V-258081	RHEL 9 must have policycoreutils package installed.
V-258082	RHEL 9 policycoreutils-python-utils package must be installed.
V-258083	RHEL 9 must have the sudo package installed.
V-258084	RHEL 9 must require reauthentication when using the "sudo" command.
V-258085	RHEL 9 must use the invoking user's password for privilege escalation when using "sudo".
V-258086	RHEL 9 must require users to reauthenticate for privilege escalation.	Users had to make a conscious decision to set "NOPASSWD" in sudoers on a running system. Automatically undoing these settings could negatively impact the system.
V-258087	RHEL 9 must restrict privilege elevation to authorized personnel.
V-258088	RHEL 9 must restrict the use of the "su" command.
V-258089	RHEL 9 fapolicy module must be installed.
V-258090	RHEL 9 fapolicy module must be enabled.
V-258091	RHEL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.	This is getting set in the /etc/security/pwquality.conf file, while the check is looking in /etc/pam.d/system-auth. The check should be updated to look in the correct file.
V-258094	RHEL 9 must not allow blank or null passwords.
V-258097	RHEL 9 must ensure the password complexity module is enabled in the password-auth file.
V-258098	RHEL 9 must ensure the password complexity module is enabled in the system-auth file.
V-258099	RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.
V-258100	RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.
V-258101	RHEL 9 must enforce password complexity rules for the root account.
V-258102	RHEL 9 must enforce password complexity by requiring that at least one lowercase character be used.
V-258103	RHEL 9 must enforce password complexity by requiring that at least one numeric character be used.
V-258104	RHEL 9 passwords for new users or password changes must have a 24 hours minimum password lifetime restriction in /etc/login.defs.
V-258105	RHEL 9 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.	We do not currently have the ability to identify and remediate existing users who do not have this set appropriately, only new users.
V-258106	RHEL 9 must require users to provide a password for privilege escalation.	Users had to make a conscious decision to set "NOPASSWD" in sudoers on a running system. Automatically undoing these settings could negatively impact the system.
V-258107	RHEL 9 passwords must be created with a minimum of 15 characters.
V-258109	RHEL 9 must enforce password complexity by requiring that at least one special character be used.
V-258110	RHEL 9 must prevent the use of dictionary words for passwords.
V-258111	RHEL 9 must enforce password complexity by requiring that at least one uppercase character be used.
V-258112	RHEL 9 must require the change of at least eight characters when passwords are changed.
V-258113	RHEL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
V-258114	RHEL 9 must require the maximum number of repeating characters be limited to three when passwords are changed.
V-258115	RHEL 9 must require the change of at least four character classes when passwords are changed.
V-258116	RHEL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
V-258117	RHEL 9 must be configured to use the shadow file to store only encrypted representations of passwords.
V-258118	RHEL 9 must not be configured to bypass password requirements for privilege escalation.	Enforcing this rule will only remove !authenticate from the /etc/sudoers file. Any custom files within /etc/sudoers.d will not be modified.
V-258120	RHEL 9 must not have accounts configured with blank or null passwords.
V-258121	RHEL 9 must use the common access card (CAC) smart card driver.
V-258122	RHEL 9 must enable certificate based smart card authentication.	This is getting set in the /etc/sssd/conf.d/50_puppet_service_pam.conf file, while the check is looking in /etc/sssd/sssd.conf. The check should be updated to look in the correct file.
V-258123	RHEL 9 must implement certificate status checking for multifactor authentication.	This is getting set in the /etc/sssd/conf.d/99999_puppet_custom.conf file, while the check is looking in /etc/sssd/conf.d/certificate_verification.conf. The check should be updated to look in the correct file.
V-258124	RHEL 9 must have the pcsc-lite package installed.
V-258125	The pcscd service on RHEL 9 must be active.
V-258126	RHEL 9 must have the opensc package installed.
V-258128	RHEL 9 must require authentication to access emergency mode.
V-258129	RHEL 9 must require authentication to access single-user mode.
V-258133	RHEL 9 must prohibit the use of cached authenticators after one day.
V-258134	RHEL 9 must have the AIDE package installed.
V-258137	RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.	This is getting set in the /etc/aide.conf.d/audit_config.aide file, while the check is looking in /etc/aide.conf. The check should be updated to look in the correct file.
V-258140	RHEL 9 must have the rsyslog package installed.
V-258141	RHEL 9 must have the packages required for encrypting offloaded audit logs installed.
V-258142	The rsyslog service on RHEL 9 must be active.
V-258143	RHEL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
V-258144	All RHEL 9 remote access methods must be monitored.	This is getting set in the /etc/rsyslog.simp.d/99_simp_local/99_remote_access_methods.conf file, while the check is looking in /etc/rsyslog.conf. The check should be updated to look in the correct file.
V-258145	RHEL 9 must be configured to offload audit records onto a different system from the system being audited via syslog.
V-258146	RHEL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.	The rule wants $ActionSendStreamDriverMode to be set to '1', however, this is the legacy format for setting this parameter. The product will correctly set StreamDriver.Mode to '1' in the imptcp module of /etc/rsyslog.simp.d/00_simp_pre_logging/global.conf, which will achieve the same thing.
V-258147	RHEL 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.	The rule wants $ActionSendStreamDriverMode to be set to '1', however, this is the legacy format for setting this parameter. The product will correctly set StreamDriver.Mode to '1' in the imptcp module of /etc/rsyslog.simp.d/00_simp_pre_logging/global.conf, which will achieve the same thing.
V-258148	RHEL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.	The rule wants $DefaultNetstreamDriver to be set to 'gtls', however, this is the legacy format for setting this parameter. The product will correctly set defaultNetstreamDriver to 'gtls' in the global section of /etc/rsyslog.simp.d/00_simp_pre_logging/global.conf, which will achieve the same thing.
V-258151	RHEL 9 audit package must be installed.
V-258152	RHEL 9 audit service must be enabled.
V-258153	RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs.
V-258154	RHEL 9 audit system must take appropriate action when the audit storage volume is full.
V-258156	RHEL 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
V-258157	RHEL 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
V-258158	RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
V-258159	RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
V-258160	RHEL 9 audit system must take appropriate action when the audit files have reached maximum size.
V-258161	RHEL 9 must label all offloaded audit logs before sending them to the central log server.
V-258162	RHEL 9 must take appropriate action when the internal event queue is full.
V-258163	RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
V-258164	RHEL 9 audit system must audit local events.
V-258165	RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
V-258166	RHEL 9 audit log directory must be owned by root to prevent unauthorized read access.
V-258167	RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
V-258168	RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.
V-258169	RHEL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.
V-258170	RHEL 9 must write audit records to disk.
V-258171	RHEL 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.	The product will set the mode of the files referenced in this rule to "700" and "600" rather then "750" and "640". This will lock down the files and keep them secure so only admins and ISSMs can access them.
V-258172	RHEL 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.	The product will set the mode of the files referenced in this rule to "700" and "600" rather then "750" and "640". This will lock down the files and keep them secure so only admins and ISSMs can access them.
V-258173	RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.
V-258175	RHEL 9 audispd-plugins package must be installed.
V-258176	RHEL 9 must audit uses of the "execve" system call.
V-258177	RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
V-258178	RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
V-258179	RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
V-258180	RHEL 9 must audit all uses of umount system calls.
V-258181	RHEL 9 must audit all uses of the chacl command.
V-258182	RHEL 9 must audit all uses of the setfacl command.
V-258183	RHEL 9 must audit all uses of the chcon command.
V-258184	RHEL 9 must audit all uses of the semanage command.
V-258185	RHEL 9 must audit all uses of the setfiles command.
V-258186	RHEL 9 must audit all uses of the setsebool command.
V-258187	RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
V-258188	RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
V-258189	RHEL 9 must audit all uses of the delete_module system call.
V-258190	RHEL 9 must audit all uses of the init_module and finit_module system calls.
V-258191	RHEL 9 must audit all uses of the chage command.
V-258192	RHEL 9 must audit all uses of the chsh command.
V-258193	RHEL 9 must audit all uses of the crontab command.
V-258194	RHEL 9 must audit all uses of the gpasswd command.
V-258195	RHEL 9 must audit all uses of the kmod command.
V-258196	RHEL 9 must audit all uses of the newgrp command.
V-258197	RHEL 9 must audit all uses of the pam_timestamp_check command.
V-258198	RHEL 9 must audit all uses of the passwd command.
V-258199	RHEL 9 must audit all uses of the postdrop command.
V-258200	RHEL 9 must audit all uses of the postqueue command.
V-258201	RHEL 9 must audit all uses of the ssh-agent command.
V-258202	RHEL 9 must audit all uses of the ssh-keysign command.
V-258203	RHEL 9 must audit all uses of the su command.
V-258204	RHEL 9 must audit all uses of the sudo command.
V-258205	RHEL 9 must audit all uses of the sudoedit command.
V-258206	RHEL 9 must audit all uses of the unix_chkpwd command.
V-258207	RHEL 9 must audit all uses of the unix_update command.
V-258208	RHEL 9 must audit all uses of the userhelper command.
V-258209	RHEL 9 must audit all uses of the usermod command.
V-258210	RHEL 9 must audit all uses of the mount command.
V-258211	Successful/unsuccessful uses of the init command in RHEL 9 must generate an audit record.
V-258212	Successful/unsuccessful uses of the poweroff command in RHEL 9 must generate an audit record.
V-258213	Successful/unsuccessful uses of the reboot command in RHEL 9 must generate an audit record.
V-258214	Successful/unsuccessful uses of the shutdown command in RHEL 9 must generate an audit record.
V-258215	Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record.
V-258216	Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record.
V-258217	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
V-258218	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
V-258219	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
V-258220	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
V-258221	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
V-258222	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
V-258223	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
V-258224	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
V-258225	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
V-258226	RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.
V-258227	RHEL 9 must take appropriate action when a critical audit processing failure occurs.
V-258228	RHEL 9 audit system must protect logon UIDs from unauthorized change.
V-258229	RHEL 9 audit system must protect auditing rules from unauthorized change.
V-258233	RHEL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.