xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_cis_server_l1

Guide to the Secure Configuration of AlmaLinux OS 9

with profile CIS AlmaLinux OS 9 Benchmark for Level 1 - Server
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® AlmaLinux OS 9 Benchmark™, v2.0.0, released 2024-06-24. This profile includes Center for Internet Security® AlmaLinux OS 9 CIS Benchmarks™ content.

The SCAP Security Guide Project
https://www.open-scap.org/security-policies/scap-security-guide

This guide presents a catalog of security-relevant configuration settings for AlmaLinux OS 9. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.

Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Evaluation Characteristics

Evaluation target	almalinux-s-2vcpu-2gb-nyc1-01
Benchmark URL	#scap_org.open-scap_comp_ssg-almalinux9-xccdf.xml
Benchmark ID	xccdf_org.ssgproject.content_benchmark_ALMALINUX-9
Benchmark version	0.1.76
Profile ID	xccdf_org.ssgproject.content_profile_cis_server_l1
Started at	2025-06-26T17:28:20+00:00
Finished at	2025-06-26T17:28:58+00:00
Performed by	root
Test system	cpe:/a:redhat:openscap:1.3.12

CPE Platforms

cpe:/o:almalinux:almalinux:9

Addresses

IPv4 127.0.0.1
IPv4 143.244.175.97
IPv4 10.10.0.5
IPv4 10.116.0.5
IPv6 0:0:0:0:0:0:0:1
IPv6 fe80:0:0:0:4c20:72ff:feab:243d
IPv6 fe80:0:0:0:ecaa:52ff:fe2b:32ba
MAC 00:00:00:00:00:00
MAC 4E:20:72:AB:24:3D
MAC EE:AA:52:2B:32:BA

Compliance and Scoring

The target system did not satisfy the conditions of 9 rules! Please review rule results and consider applying remediation.

Rule results

246 passed

9 failed

0 other

Severity of failed rules

1 other

1 low

6 medium

1 high

Score

Scoring system	Score	Maximum	Percent
urn:xccdf:scoring:default	95.533112	100.000000	95.53%

Rule Overview

Title	Severity	Result
Guide to the Secure Configuration of AlmaLinux OS 9 9x fail
System Settings 8x fail
Installing and Maintaining Software 1x fail
System and Software Integrity
Software Integrity Checking
Verify Integrity with AIDE
Install AIDE	medium	pass
Build and Test AIDE Database	medium	pass
Configure AIDE to Verify the Audit Tools	medium	pass
Configure Periodic Execution of AIDE	medium	pass
System Cryptographic Policies
Configure System Cryptography Policy	high	pass
Configure SSH to use System Crypto Policy	medium	pass
Disk Partitioning 1x fail
Ensure /dev/shm is configured	low	pass
Ensure /tmp Located On Separate Partition	low	fail
GNOME Desktop Environment
Configure GNOME Login Screen
Disable the GNOME3 Login User List	medium	notapplicable
Disable XDMCP in GDM	high	notapplicable
GNOME Media Settings
Disable GNOME3 Automounting	medium	notapplicable
Disable GNOME3 Automount Opening	medium	notapplicable
Disable GNOME3 Automount running	low	notapplicable
Configure GNOME Screen Locking
Set GNOME3 Screensaver Inactivity Timeout	medium	notapplicable
Set GNOME3 Screensaver Lock Delay After Activation Period	medium	notapplicable
Ensure Users Cannot Change GNOME3 Screensaver Settings	medium	notapplicable
Ensure Users Cannot Change GNOME3 Session Idle Settings	medium	notapplicable
Make sure that the dconf databases are up-to-date with regards to respective keyfiles	high	notapplicable
Sudo
Install sudo Package	medium	pass
Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty	medium	pass
Ensure Sudo Logfile Exists - sudo logfile	low	pass
Require Re-Authentication When Using the sudo Command	medium	pass
Updating Software
Ensure gpgcheck Enabled In Main dnf Configuration	high	pass
Account and Access Control 1x fail
Warning Banners for System Accesses
Implement a GUI Warning Banner
Enable GNOME3 Login Warning Banner	medium	notapplicable
Set the GNOME3 Login Warning Banner Text	medium	notapplicable
Ensure Local Login Warning Banner Is Configured Properly	medium	pass
Ensure Remote Login Warning Banner Is Configured Properly	medium	pass
Ensure Message Of The Day Is Configured Properly	medium	pass
Verify Group Ownership of System Login Banner	medium	pass
Verify Group Ownership of System Login Banner for Remote Connections	medium	pass
Verify Group Ownership of Message of the Day Banner	medium	pass
Verify ownership of System Login Banner	medium	pass
Verify ownership of System Login Banner for Remote Connections	medium	pass
Verify ownership of Message of the Day Banner	medium	pass
Verify permissions on System Login Banner	medium	pass
Verify permissions on System Login Banner for Remote Connections	medium	pass
Verify permissions on Message of the Day Banner	medium	pass
Protect Accounts by Configuring PAM
Set Lockouts for Failed Password Attempts
Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.	medium	pass
Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.	medium	pass
Limit Password Reuse: password-auth	medium	pass
Limit Password Reuse: system-auth	medium	pass
Lock Accounts After Failed Password Attempts	medium	pass
Set Lockout Time for Failed Password Attempts	medium	pass
Set Password Quality Requirements
Set Password Quality Requirements with pam_pwquality
Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words	medium	pass
Ensure PAM Enforces Password Requirements - Minimum Different Characters	medium	pass
Ensure PAM Enforces Password Requirements - Enforce for root User	medium	pass
Set Password Maximum Consecutive Repeating Characters	medium	pass
Ensure PAM Enforces Password Requirements - Minimum Different Categories	medium	pass
Ensure PAM Enforces Password Requirements - Minimum Length	medium	pass
Set Password Hashing Algorithm
Set Password Hashing Algorithm in /etc/libuser.conf	medium	pass
Set Password Hashing Algorithm in /etc/login.defs	medium	pass
Set PAM''s Password Hashing Algorithm - password-auth	medium	pass
Set PAM''s Password Hashing Algorithm	medium	pass
Install pam_pwquality Package	medium	pass
Protect Accounts by Restricting Password-Based Login 1x fail
Set Account Expiration Parameters
Set Account Expiration Following Inactivity	medium	pass
Ensure All Accounts on the System Have Unique Names	medium	pass
Set Password Expiration Parameters
Set Password Maximum Age	medium	pass
Set Existing Passwords Maximum Age	medium	pass
Set Existing Passwords Warning Age	medium	pass
Set Password Warning Age	medium	pass
Set existing passwords a period of inactivity before they been locked	medium	pass
Verify Proper Storage and Existence of Password Hashes
Verify All Account Password Hashes are Shadowed	medium	pass
Ensure all users last password change date is in the past	medium	pass
All GIDs referenced in /etc/passwd must be defined in /etc/group	low	pass
Prevent Login to Accounts With Empty Password	high	pass
Ensure There Are No Accounts With Blank or Null Passwords	high	pass
Verify No .forward Files Exist	medium	pass
Verify No netrc Files Exist	medium	pass
Restrict Root Logins 1x fail
Verify Only Root Has UID 0	high	pass
Verify Root Has A Primary GID 0	high	pass
Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty	medium	pass
Ensure Authentication Required for Single User Mode	medium	fail
Ensure that System Accounts Are Locked	medium	pass
Ensure that System Accounts Do Not Run a Shell Upon Login	medium	pass
Enforce Usage of pam_wheel with Group Parameter for su Authentication	medium	pass
Ensure All Accounts on the System Have Unique User IDs	medium	pass
Ensure All Groups on the System Have Unique Group ID	medium	pass
Secure Session Configuration Files for Login Accounts
Ensure that No Dangerous Directories Exist in Root's Path
Ensure that Root's Path Does Not Include World or Group-Writable Directories	medium	pass
Ensure that Root's Path Does Not Include Relative Paths or Null Directories	unknown	pass
Ensure that Users Have Sensible Umask Values
Ensure the Default Bash Umask is Set Correctly	medium	pass
Ensure the Default Umask is Set Correctly in login.defs	medium	pass
Ensure the Default Umask is Set Correctly in /etc/profile	medium	pass
Set Interactive Session Timeout	medium	pass
User Initialization Files Must Be Group-Owned By The Primary Group	medium	pass
User Initialization Files Must Not Run World-Writable Programs	medium	pass
User Initialization Files Must Be Owned By the Primary User	medium	pass
All Interactive Users Home Directories Must Exist	medium	pass
Ensure All User Initialization Files Have Mode 0740 Or Less Permissive	medium	pass
All Interactive User Home Directories Must Have mode 0750 Or Less Permissive	medium	pass
Enable authselect	medium	pass
GRUB2 bootloader configuration 1x fail
Non-UEFI GRUB2 bootloader configuration 1x fail
Verify /boot/grub2/grub.cfg Group Ownership	medium	pass
Verify /boot/grub2/user.cfg Group Ownership	medium	pass
Verify /boot/grub2/grub.cfg User Ownership	medium	pass
Verify /boot/grub2/user.cfg User Ownership	medium	pass
Verify /boot/grub2/grub.cfg Permissions	medium	pass
Verify /boot/grub2/user.cfg Permissions	medium	pass
Set Boot Loader Password in grub2	high	fail
Configure Syslog 1x fail
Ensure Proper Configuration of Log Files
Ensure Log Files Are Owned By Appropriate Group	medium	pass
Ensure Log Files Are Owned By Appropriate User	medium	pass
Ensure System Log Files Have Correct Permissions	medium	pass
systemd-journald 1x fail
Install systemd-journal-remote Package	medium	pass
Enable systemd-journald Service	medium	pass
Ensure journald is configured to compress large log files	medium	pass
Ensure journald is configured to write log files to persistent disk	medium	pass
Disable systemd-journal-remote Socket	medium	fail
Network Configuration and Firewalls 4x fail
firewalld 3x fail
Inspect and Activate Default firewalld Rules 1x fail
Install firewalld Package	medium	pass
Verify firewalld Enabled	medium	fail
Strengthen the Default Ruleset 2x fail
Configure Firewalld to Restrict Loopback Traffic	medium	fail
Configure Firewalld to Trust Loopback Traffic	medium	fail
IPv6
Configure IPv6 Settings if Necessary
Configure Accepting Router Advertisements on All IPv6 Interfaces	medium	pass
Disable Accepting ICMP Redirects for All IPv6 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces	medium	pass
Disable Kernel Parameter for IPv6 Forwarding	medium	pass
Disable Accepting Router Advertisements on all IPv6 Interfaces by Default	medium	pass
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default	medium	pass
Kernel Parameters Which Affect Networking
Network Related Kernel Runtime Parameters for Hosts and Routers
Disable Accepting ICMP Redirects for All IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces	medium	pass
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces	unknown	pass
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default	medium	pass
Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default	unknown	pass
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default	medium	pass
Configure Kernel Parameter for Accepting Secure Redirects By Default	medium	pass
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces	medium	pass
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces	unknown	pass
Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces	medium	pass
Network Parameters for Hosts Only
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default	medium	pass
Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces	medium	pass
nftables 1x fail
Install nftables Package	medium	pass
Verify nftables Service is Disabled	medium	fail
Wireless Networking
Disable Wireless Through Software Configuration
Disable Bluetooth Service	medium	pass
Deactivate Wireless Network Interfaces	medium	notapplicable
File Permissions and Masks
Verify Permissions on Important Files and Directories
Verify Permissions on Files with Local Account Information and Credentials
Verify Permissions and Ownership of Old Passwords File	medium	pass
Verify Group Who Owns Backup group File	medium	pass
Verify Group Who Owns Backup gshadow File	medium	pass
Verify Group Who Owns Backup passwd File	medium	pass
Verify User Who Owns Backup shadow File	medium	pass
Verify Group Who Owns group File	medium	pass
Verify Group Who Owns gshadow File	medium	pass
Verify Group Who Owns passwd File	medium	pass
Verify Group Who Owns shadow File	medium	pass
Verify Group Who Owns /etc/shells File	medium	pass
Verify User Who Owns Backup group File	medium	pass
Verify User Who Owns Backup gshadow File	medium	pass
Verify User Who Owns Backup passwd File	medium	pass
Verify Group Who Owns Backup shadow File	medium	pass
Verify User Who Owns group File	medium	pass
Verify User Who Owns gshadow File	medium	pass
Verify User Who Owns passwd File	medium	pass
Verify User Who Owns shadow File	medium	pass
Verify Who Owns /etc/shells File	medium	pass
Verify Permissions on Backup group File	medium	pass
Verify Permissions on Backup gshadow File	medium	pass
Verify Permissions on Backup passwd File	medium	pass
Verify Permissions on Backup shadow File	medium	pass
Verify Permissions on group File	medium	pass
Verify Permissions on gshadow File	medium	pass
Verify Permissions on passwd File	medium	pass
Verify Permissions on shadow File	medium	pass
Verify Permissions on /etc/shells File	medium	pass
Verify that All World-Writable Directories Have Sticky Bits Set	medium	pass
Ensure No World-Writable Files Exist	medium	pass
Ensure All Files Are Owned by a Group	medium	pass
Ensure All Files Are Owned by a User	medium	pass
Restrict Dynamic Mounting and Unmounting of Filesystems
Disable the Automounter	medium	notapplicable
Disable Mounting of cramfs	low	pass
Disable Mounting of freevxfs	low	pass
Disable Mounting of hfs	low	pass
Disable Mounting of hfsplus	low	pass
Disable Mounting of jffs2	low	pass
Disable Modprobe Loading of USB Storage Driver	medium	pass
Restrict Partition Mount Options
Add nodev Option to /dev/shm	medium	pass
Add noexec Option to /dev/shm	medium	pass
Add nosuid Option to /dev/shm	medium	pass
Add nodev Option to /home	unknown	notapplicable
Add nosuid Option to /home	medium	notapplicable
Add nodev Option to /tmp	medium	notapplicable
Add noexec Option to /tmp	medium	notapplicable
Add nosuid Option to /tmp	medium	notapplicable
Add nodev Option to /var/log/audit	medium	notapplicable
Add noexec Option to /var/log/audit	medium	notapplicable
Add nosuid Option to /var/log/audit	medium	notapplicable
Add nodev Option to /var/log	medium	notapplicable
Add noexec Option to /var/log	medium	notapplicable
Add nosuid Option to /var/log	medium	notapplicable
Add nodev Option to /var	medium	notapplicable
Add nosuid Option to /var	medium	notapplicable
Add nodev Option to /var/tmp	medium	notapplicable
Add noexec Option to /var/tmp	medium	notapplicable
Add nosuid Option to /var/tmp	medium	notapplicable
Restrict Programs from Dangerous Execution Patterns
Disable Core Dumps
Disable core dump backtraces	medium	pass
Disable storing core dump	medium	pass
Enable ExecShield
Enable Randomized Layout of Virtual Address Space	medium	pass
Restrict usage of ptrace to descendant processes	medium	pass
SELinux
Install libselinux Package	high	pass
Uninstall mcstrans Package	low	pass
Uninstall setroubleshoot Package	low	pass
Ensure SELinux Not Disabled in /etc/default/grub	medium	pass
Ensure SELinux is Not Disabled	high	pass
Configure SELinux Policy	medium	pass
Services 1x fail
Avahi Server
Disable Avahi Server if Possible
Disable Avahi Server Software	medium	notapplicable
Cron and At Daemons
Restrict at and cron to Authorized Users if Necessary
Ensure that /etc/at.deny does not exist	medium	pass
Ensure that /etc/cron.allow exists	medium	pass
Ensure that /etc/cron.deny does not exist	medium	pass
Verify Group Who Owns /etc/at.allow file	medium	pass
Verify Group Who Owns /etc/cron.allow file	medium	pass
Verify User Who Owns /etc/cron.allow file	medium	pass
Verify Permissions on /etc/at.allow file	medium	pass
Verify Permissions on /etc/cron.allow file	medium	pass
Install the cron service	medium	pass
Enable cron Service	medium	pass
Verify Group Who Owns cron.d	medium	pass
Verify Group Who Owns cron.daily	medium	pass
Verify Group Who Owns cron.hourly	medium	pass
Verify Group Who Owns cron.monthly	medium	pass
Verify Group Who Owns cron.weekly	medium	pass
Verify Group Who Owns Crontab	medium	pass
Verify Owner on cron.d	medium	pass
Verify Owner on cron.daily	medium	pass
Verify Owner on cron.hourly	medium	pass
Verify Owner on cron.monthly	medium	pass
Verify Owner on cron.weekly	medium	pass
Verify Owner on crontab	medium	pass
Verify Permissions on cron.d	medium	pass
Verify Permissions on cron.daily	medium	pass
Verify Permissions on cron.hourly	medium	pass
Verify Permissions on cron.monthly	medium	pass
Verify Permissions on cron.weekly	medium	pass
Verify Permissions on crontab	medium	pass
DHCP
Disable DHCP Server
Uninstall DHCP Server Package	medium	pass
DNS Server
Disable DNS Server
Uninstall bind Package	low	pass
Uninstall dnsmasq Package	low	pass
FTP Server
Disable vsftpd if Possible
Uninstall vsftpd Package	high	pass
Remove ftp Package	low	pass
Web Server
Disable Apache if Possible
Uninstall httpd Package	unknown	pass
Disable NGINX if Possible
Uninstall nginx Package	unknown	pass
IMAP and POP3 Server
Disable Cyrus IMAP
Uninstall cyrus-imapd Package	unknown	pass
Disable Dovecot
Uninstall dovecot Package	unknown	pass
Mail Server Software
Configure SMTP For Mail Clients
Disable Postfix Network Listening	medium	notapplicable
Ensure Mail Transfer Agent is not Listening on any non-loopback Address	medium	pass
NFS and RPC
Disable All NFS Services if Possible
Disable Services Used Only by NFS
Disable rpcbind Service	low	pass
Configure NFS Clients
Disable NFS Server Daemons
Disable Network File System (nfs)	unknown	pass
Network Time Protocol
The Chrony package is installed	medium	pass
A remote time server for Chrony is configured	medium	pass
Ensure that chronyd is running under chrony user account	medium	pass
Obsolete Services
Xinetd
Uninstall xinetd Package	low	pass
NIS
Remove NIS Client	unknown	pass
Uninstall ypserv Package	high	pass
Rlogin, Rsh, and Rexec
Remove Rsh Trust Files	high	notapplicable
Telnet
Uninstall telnet-server Package	high	pass
Remove telnet Clients	low	pass
TFTP Server
Uninstall tftp-server Package	high	pass
Remove tftp Daemon	low	pass
Uninstall rsync Package	medium	pass
Print Support
Disable the CUPS Service	unknown	pass
Proxy Server
Disable Squid if Possible
Uninstall squid Package	unknown	pass
Samba(SMB) Microsoft Windows File Sharing Server
Disable Samba if Possible
Uninstall Samba Package	unknown	pass
SNMP Server
Disable SNMP Server if Possible
Uninstall net-snmp Package	unknown	pass
SSH Server 1x fail
Configure OpenSSH Server if Necessary 1x fail
Set SSH Client Alive Count Max	medium	pass
Set SSH Client Alive Interval	medium	pass
Disable Host-Based Authentication	medium	pass
Disable SSH Access via Empty Passwords	high	pass
Disable SSH Support for .rhosts Files	medium	pass
Disable SSH Root Login	medium	pass
Do Not Allow SSH Environment Options	medium	pass
Enable PAM	medium	pass
Enable SSH Warning Banner	medium	pass
Limit Users' SSH Access	unknown	fail
Ensure SSH LoginGraceTime is configured	medium	pass
Set SSH Daemon LogLevel to VERBOSE	medium	pass
Set SSH authentication attempt limit	medium	pass
Set SSH MaxSessions limit	medium	pass
Ensure SSH MaxStartups is configured	medium	pass
Use Only Strong Key Exchange algorithms	medium	pass
Use Only Strong MACs	medium	pass
Verify Group Who Owns SSH Server config file	medium	pass
Verify Group Ownership on SSH Server Private *_key Key Files	medium	pass
Verify Group Ownership on SSH Server Public *.pub Key Files	medium	pass
Verify Owner on SSH Server config file	medium	pass
Verify Ownership on SSH Server Private *_key Key Files	medium	pass
Verify Ownership on SSH Server Public *.pub Key Files	medium	pass
Verify Permissions on SSH Server config file	medium	pass
Verify Permissions on SSH Server Private *_key Key Files	medium	pass
Verify Permissions on SSH Server Public *.pub Key Files	medium	pass

Result Details

Install AIDE

Rule ID xccdf_org.ssgproject.content_rule_package_aide_installed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_aide_installed:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9
cjis	5.10.1.3
cobit5	APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06
disa	CCI-002696, CCI-001744
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4
isa-62443-2013	SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6
ism	1034, 1288, 1341, 1417
iso27001-2013	A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3
nist	CM-6(a)
nist-csf	DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3
pcidss	Req-11.5
os-srg	SRG-OS-000445-GPOS-00199
anssi	R76, R79
cis	6.1.1
pcidss4	11.5.2

Description

The aide package can be installed with the following command:

$ sudo dnf install aide

Rationale

The AIDE package must be installed if it is to be available for integrity checking.

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	aide	x86_64	(none)	103.el9	0.16	0:0.16-103.el9	d36cb86cb86b3716	aide-0:0.16-103.el9.x86_64

Build and Test AIDE Database

Rule ID xccdf_org.ssgproject.content_rule_aide_build_database

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-aide_build_database:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9
cjis	5.10.1.3
cobit5	APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06
disa	CCI-002696, CCI-001744
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4
isa-62443-2013	SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6
iso27001-2013	A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3
nist	CM-6(a)
nist-csf	DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3
pcidss	Req-11.5
os-srg	SRG-OS-000445-GPOS-00199
anssi	R76, R79
cis	6.1.1
pcidss4	11.5.2

Description

Run the following command to generate a new database:

$ sudo /usr/sbin/aide --init

By default, the database will be written to the file /var/lib/aide/aide.db.new.gz. Storing the database, the configuration file /etc/aide.conf, and the binary /usr/sbin/aide (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:

$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

To initiate a manual check, run the following command:

$ sudo /usr/sbin/aide --check

If this check produces any unexpected output, investigate.

Rationale

For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files.

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	aide	x86_64	(none)	103.el9	0.16	0:0.16-103.el9	d36cb86cb86b3716	aide-0:0.16-103.el9.x86_64

Testing existence of operational aide database file oval:ssg-test_aide_operational_database_absolute_path:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Type	UID	GID	Size (B)	Permissions
not evaluated	/var/lib/aide/aide.db.gz	regular	0	0	2337481	`rw-------`

Configure AIDE to Verify the Audit Tools

Rule ID

xccdf_org.ssgproject.content_rule_aide_check_audit_tools

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-aide_check_audit_tools:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

disa	CCI-001496, CCI-001494, CCI-001495, CCI-001493
nist	AU-9(3), AU-9(3).1
os-srg	SRG-OS-000278-GPOS-00108
cis	6.1.3

Description

The operating system file integrity tool must be configured to protect the integrity of the audit tools.

Rationale

Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit tools include but are not limited to vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files.

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	aide	x86_64	(none)	103.el9	0.16	0:0.16-103.el9	d36cb86cb86b3716	aide-0:0.16-103.el9.x86_64

auditctl is checked in /etc/aide.conf oval:ssg-test_aide_verify_auditctl:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/aide.conf	/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

auditd is checked in /etc/aide.conf oval:ssg-test_aide_verify_auditd:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/aide.conf	/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

ausearch is checked in /etc/aide.conf oval:ssg-test_aide_verify_ausearch:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/aide.conf	/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

aureport is checked in /etc/aide.conf oval:ssg-test_aide_verify_aureport:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/aide.conf	/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

autrace is checked in /etc/aide.conf oval:ssg-test_aide_verify_autrace:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/aide.conf	/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

rsyslogd is checked in /etc/aide.conf oval:ssg-test_aide_verify_rsyslogd:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/aide.conf	/usr/sbin/rsyslogd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

augenrules is checked in /etc/aide.conf oval:ssg-test_aide_verify_augenrules:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/aide.conf	/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

Configure Periodic Execution of AIDE

Rule ID xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-aide_periodic_cron_checking:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9
cjis	5.10.1.3
cobit5	APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06
disa	CCI-002702, CCI-001744, CCI-002699
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4
isa-62443-2013	SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6
iso27001-2013	A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3
nist	SI-7, SI-7(1), CM-6(a)
nist-csf	DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3
pcidss	Req-11.5
os-srg	SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201
anssi	R76
cis	6.1.2
pcidss4	11.5.2

Description

At a minimum, AIDE should be configured to run a weekly scan. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:

05 4 * * * root /usr/sbin/aide --check

To implement a weekly execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:

05 4 * * 0 root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example. The usage of cron's special time codes, such as @daily and @weekly is acceptable.

Rationale

By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files.

Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.

Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	aide	x86_64	(none)	103.el9	0.16	0:0.16-103.el9	d36cb86cb86b3716	aide-0:0.16-103.el9.x86_64

run aide with cron oval:ssg-test_aide_periodic_cron_checking:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/crontab	05 4 * * * root /usr/sbin/aide --check

run aide with cron oval:ssg-test_aide_crond_checking:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_test_aide_crond_checking:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/cron.d	^.*$	^(([0-9][\s][0-9][\s]\[\s]\[\s](\\|([0-7]\|mon\|tue\|wed\|thu\|fri\|sat\|sun)\|[0-7]-[0-7]))\|@(hourly\|daily\|weekly))[\s]root[\s]\/usr\/sbin\/aide[\s]\-\-check.*$	1

run aide with cron oval:ssg-test_aide_var_cron_checking:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_var_cron_checking:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/var/spool/cron/root	^(([0-9][\s][0-9][\s]\[\s]\[\s](\\|([0-7]\|mon\|tue\|wed\|thu\|fri\|sat\|sun)\|[0-7]-[0-7]))\|@(hourly\|daily\|weekly))[\s](root)?[\s]\/usr\/sbin\/aide[\s]\-\-check.*$	1

run aide with cron.(daily|weekly) oval:ssg-test_aide_crontabs_checking:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_crontabs_checking:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
^/etc/cron.(daily\|weekly)$	^.*$	^[^#]\/usr\/sbin\/aide\s+\-\-check\s$	1

Configure System Cryptography Policy

Rule ID xccdf_org.ssgproject.content_rule_configure_crypto_policy

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-configure_crypto_policy:def:1

Time 2025-06-26T17:28:20+00:00

Severity high

References:

disa	CCI-000068, CCI-003123, CCI-002450, CCI-000877, CCI-002418, CCI-001453, CCI-002890
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii)
ism	1446
nerc-cip	CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1
nist	AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3)
ospp	FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1
os-srg	SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174
cis	1.6.1
pcidss4	2.2.7, 2.2

Description

To configure the system cryptography policy to use ciphers only from the DEFAULT:NO-SHA1 policy, run the following command:

$ sudo update-crypto-policies --set DEFAULT:NO-SHA1

The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the /etc/crypto-policies/back-ends are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied. Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.

Rationale

Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.

Warnings

warning The system needs to be rebooted for these changes to take effect.

warning System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

OVAL test results details

check for crypto policy correctly configured in /etc/crypto-policies/config oval:ssg-test_configure_crypto_policy:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/crypto-policies/config	DEFAULT:NO-SHA1

check for crypto policy correctly configured in /etc/crypto-policies/state/current oval:ssg-test_configure_crypto_policy_current:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/crypto-policies/state/current	DEFAULT:NO-SHA1

Check if update-crypto-policies has been run oval:ssg-test_crypto_policies_updated:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-variable_crypto_policies_config_file_timestamp:var:1	1750958826

Check if /etc/crypto-policies/back-ends/nss.config exists oval:ssg-test_crypto_policy_nss_config:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Type	UID	GID	Size (B)	Permissions
not evaluated	/etc/crypto-policies/back-ends/nss.config	regular	0	0	401	`rw-r--r--`

Configure SSH to use System Crypto Policy

Rule ID xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-configure_ssh_crypto_policy:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-001453
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii)
nerc-cip	CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1
nist	AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13
ospp	FCS_SSH_EXT.1, FCS_SSHS_EXT.1, FCS_SSHC_EXT.1
pcidss	Req-2.2
os-srg	SRG-OS-000250-GPOS-00093
cis	1.6.2
pcidss4	2.2.7, 2.2

Description

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. SSH is supported by crypto policy, but the SSH configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the CRYPTO_POLICY variable is either commented or not set at all in the /etc/sysconfig/sshd.

Rationale

Overriding the system crypto policy makes the behavior of the SSH service violate expectations, and makes system configuration more fragmented.

OVAL test results details

Check that the SSH configuration mandates usage of system-wide crypto policies. oval:ssg-test_configure_ssh_crypto_policy:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_configure_ssh_crypto_policy:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/sysconfig/sshd	^\s(?i)CRYPTO_POLICY\s=.*$	1

Ensure /dev/shm is configured

Rule ID xccdf_org.ssgproject.content_rule_partition_for_dev_shm

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-partition_for_dev_shm:def:1

Time 2025-06-26T17:28:20+00:00

Severity low

References:

cis	1.1.2.2.1

Description

The /dev/shm is a traditional shared memory concept. One program will create a memory portion, which other processes (if permitted) can access. If /dev/shm is not configured, tmpfs will be mounted to /dev/shm by systemd.

Rationale

Any user can upload and execute files inside the /dev/shm similar to the /tmp partition. Configuring /dev/shm allows an administrator to set the noexec option on the mount, making /dev/shm useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.

Warnings

warning This rule does not have a remedation. It is expected that this will be managed by systemd and will be a tmpfs partition.

OVAL test results details

/dev/shm on own partition oval:ssg-testdev_shm_partition:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Mount point	Device	Uuid	Fs type	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Total space	Space used	Space left
not evaluated	/dev/shm	tmpfs		tmpfs	rw	seclabel	nosuid	nodev	noexec	inode64	252150	0	252150

Ensure /tmp Located On Separate Partition

Rule ID xccdf_org.ssgproject.content_rule_partition_for_tmp

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-partition_for_tmp:def:1

Time 2025-06-26T17:28:20+00:00

Severity low

References:

cis-csc	12, 15, 8
cobit5	APO13.01, DSS05.02
disa	CCI-000366
isa-62443-2013	SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.13.1.1, A.13.2.1, A.14.1.3
nist	CM-6(a), SC-5(2)
nist-csf	PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
cis	1.1.2.1.1

Description

The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.

Rationale

The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.

Remediation script ⇲


logvol /tmp 1024

Remediation OSBuild Blueprint snippet ⇲


[[customizations.filesystem]]
mountpoint = "/tmp"
size = 1073741824

Remediation Anaconda snippet ⇲

Complexity:	low
Disruption:	high
Reboot:	false
Strategy:	enable


part /tmp

OVAL test results details

/tmp on own partition oval:ssg-testtmp_partition:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_mounttmp_own_partition:obj:1 of type partition_object

Mount point
/tmp

Disable the GNOME3 Login User List

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-000366
nist	CM-6(a), AC-23
os-srg	SRG-OS-000480-GPOS-00227
cis	1.8.3

Description

In the default graphical environment, users logging directly into the system are greeted with a login screen that displays all known users. This functionality should be disabled by setting disable-user-list to true.

To disable, add or edit disable-user-list to /etc/dconf/db/distro.d/00-security-settings. For example:

[org/gnome/login-screen]
disable-user-list=true

Once the setting has been added, add a lock to /etc/dconf/db/distro.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/login-screen/disable-user-list

After the settings have been set, run dconf update.

Rationale

Leaving the user list enabled is a security risk since it allows anyone with physical access to the system to quickly enumerate known user accounts without logging in.

Disable XDMCP in GDM

Rule ID xccdf_org.ssgproject.content_rule_gnome_gdm_disable_xdmcp

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity high

References:

cis	1.8.10

Description

XDMCP is an unencrypted protocol, and therefore, presents a security risk, see e.g. XDMCP Gnome docs. To disable XDMCP support in Gnome, set Enable to false under the [xdmcp] configuration section in /etc/gdm/custom.conf. For example:

[xdmcp]
Enable=false

Rationale

XDMCP provides unencrypted remote access through the Gnome Display Manager (GDM) which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using XDMCP, the privileged user password could be compromised due to typed XEvents and keystrokes will traversing over the network in clear text.

Disable GNOME3 Automounting

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	12, 16
cobit5	APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03
cui	3.1.7
disa	CCI-000366, CCI-000778, CCI-001958
isa-62443-2009	4.3.3.2.2, 4.3.3.5.2, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.13, SR 1.2, SR 1.4, SR 1.5, SR 1.9, SR 2.1, SR 2.6
iso27001-2013	A.11.2.6, A.13.1.1, A.13.2.1, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-3, PR.AC-6
os-srg	SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227
cis	1.8.6, 1.8.7
pcidss4	3.4.2, 3.4

Description

The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount within GNOME3, add or set automount to false in /etc/dconf/db/local.d/00-security-settings. For example:

[org/gnome/desktop/media-handling]
automount=false

Once the settings have been added, add a lock to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/media-handling/automount

After the settings have been set, run dconf update.

Rationale

Disabling automatic mounting in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.

Disable GNOME3 Automount Opening

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	12, 16
cobit5	APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03
cui	3.1.7
disa	CCI-000778, CCI-000366, CCI-001958
isa-62443-2009	4.3.3.2.2, 4.3.3.5.2, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.13, SR 1.2, SR 1.4, SR 1.5, SR 1.9, SR 2.1, SR 2.6
iso27001-2013	A.11.2.6, A.13.1.1, A.13.2.1, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-3, PR.AC-6
os-srg	SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227
cis	1.8.6, 1.8.7
pcidss4	3.4.2, 3.4

Description

The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount-open within GNOME3, add or set automount-open to false in /etc/dconf/db/local.d/00-security-settings. For example:

[org/gnome/desktop/media-handling]
automount-open=false

Once the settings have been added, add a lock to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/media-handling/automount-open

After the settings have been set, run dconf update.

Rationale

Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Disabling automatic mounting in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.

Disable GNOME3 Automount running

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity low

References:

cis-csc	12, 16
cobit5	APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03
cui	3.1.7
disa	CCI-000366, CCI-001764, CCI-001958, CCI-000778
isa-62443-2009	4.3.3.2.2, 4.3.3.5.2, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.13, SR 1.2, SR 1.4, SR 1.5, SR 1.9, SR 2.1, SR 2.6
iso27001-2013	A.11.2.6, A.13.1.1, A.13.2.1, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-3, PR.AC-6
os-srg	SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227
cis	1.8.8, 1.8.9

Description

The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable autorun-never within GNOME3, add or set autorun-never to true in /etc/dconf/db/local.d/00-security-settings. For example:

[org/gnome/desktop/media-handling]
autorun-never=true

Once the settings have been added, add a lock to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/media-handling/autorun-never

After the settings have been set, run dconf update.

Rationale

Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Disabling automatic mount running in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.

Set GNOME3 Screensaver Inactivity Timeout

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cjis	5.5.5
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.10
disa	CCI-000057, CCI-000060
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	AC-11(a), CM-6(a)
nist-csf	PR.AC-7
pcidss	Req-8.1.8
os-srg	SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012
cis	1.8.4
pcidss4	8.2.8, 8.2

Description

The idle time-out value for inactivity in the GNOME3 desktop is configured via the idle-delay setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/local.d directory and locked in /etc/dconf/db/local.d/locks directory to prevent user modification.

For example, to configure the system for a 15 minute delay, add the following to /etc/dconf/db/local.d/00-security-settings:

[org/gnome/desktop/session]
idle-delay=uint32 900

Rationale

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME3 can be configured to identify when a user's session has idled and take action to initiate a session lock.

Set GNOME3 Screensaver Lock Delay After Activation Period

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.10
disa	CCI-000057
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	AC-11(a), CM-6(a)
nist-csf	PR.AC-7
pcidss	Req-8.1.8
os-srg	SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012
cis	1.8.4
pcidss4	8.2.8, 8.2

Description

To activate the locking delay of the screensaver in the GNOME3 desktop when the screensaver is activated, add or set lock-delay to

uint32 5

in /etc/dconf/db/local.d/00-security-settings. For example:

[org/gnome/desktop/screensaver]
lock-delay=uint32 5

After the settings have been set, run dconf update.

Rationale

A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absense.

Ensure Users Cannot Change GNOME3 Screensaver Settings

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.10
disa	CCI-000057
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	CM-6(a)
nist-csf	PR.AC-7
os-srg	SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012
cis	1.8.5

Description

If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding /org/gnome/desktop/screensaver/lock-delay to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/screensaver/lock-delay

After the settings have been set, run dconf update.

Rationale

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings.

Ensure Users Cannot Change GNOME3 Session Idle Settings

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.10
disa	CCI-000057, CCI-000060
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	CM-6(a)
nist-csf	PR.AC-7
pcidss	Req-8.1.8
os-srg	SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012
cis	1.8.5
pcidss4	8.2.8, 8.2

Description

If not already configured, ensure that users cannot change GNOME3 session idle settings by adding /org/gnome/desktop/session/idle-delay to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/session/idle-delay

After the settings have been set, run dconf update.

Rationale

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings.

Make sure that the dconf databases are up-to-date with regards to respective keyfiles

Rule ID

xccdf_org.ssgproject.content_rule_dconf_db_up_to_date

Result

notapplicable

Multi-check rule

Time

2025-06-26T17:28:20+00:00

Severity

high

References:

disa	CCI-000366
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(5)(ii)(A)
pcidss	Req-6.2
os-srg	SRG-OS-000480-GPOS-00227
cis	reload_dconf_db
pcidss4	8.2.8, 8.2

Description

By default, DConf uses a binary database as a data backend. The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by the

dconf update

command. More specifically, content present in the following directories:

/etc/dconf/db/distro.d

/etc/dconf/db/local.d

Rationale

Unlike text-based keyfiles, the binary database is impossible to check by OVAL. Therefore, in order to evaluate dconf configuration, both have to be true at the same time - configuration files have to be compliant, and the database needs to be more recent than those keyfiles, which gives confidence that it reflects them.

Install sudo Package

Rule ID xccdf_org.ssgproject.content_rule_package_sudo_installed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_sudo_installed:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-002235
ism	1382, 1384, 1386
nist	CM-6(a)
ospp	FMT_MOF_EXT.1
os-srg	SRG-OS-000324-GPOS-00125
anssi	R33
cis	5.2.1
pcidss4	2.2.6, 2.2

Description

The sudo package can be installed with the following command:

$ sudo dnf install sudo

Rationale

sudo is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.

OVAL test results details

package sudo is installed oval:ssg-test_package_sudo_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	sudo	x86_64	(none)	10.el9_3	1.9.5p2	0:1.9.5p2-10.el9_3	d36cb86cb86b3716	sudo-0:1.9.5p2-10.el9_3.x86_64

Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

Rule ID xccdf_org.ssgproject.content_rule_sudo_add_use_pty

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sudo_add_use_pty:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

pcidss	Req-10.2.5
anssi	R39
cis	5.2.2
pcidss4	2.2.6, 2.2

Description

The sudo use_pty tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the use_pty tag exists in /etc/sudoers configuration file or any sudo configuration snippets in /etc/sudoers.d/.

Rationale

Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining access to the user's terminal after the main program has finished executing.

OVAL test results details

use_pty exists in /etc/sudoers or /etc/sudoers.d/ oval:ssg-test_use_pty_sudoers:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sudoers	Defaults use_pty

Ensure Sudo Logfile Exists - sudo logfile

Rule ID

xccdf_org.ssgproject.content_rule_sudo_custom_logfile

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-sudo_custom_logfile:def:1

Time

2025-06-26T17:28:20+00:00

Severity

low

References:

pcidss	Req-10.2.5
cis	5.2.3
pcidss4	2.2.6, 2.2

Description

A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CIS, which uses /var/log/sudo.log.

Rationale

A sudo log file simplifies auditing of sudo commands.

OVAL test results details

logfile exists in /etc/sudoers or /etc/sudoers.d/ oval:ssg-test_logfile_sudoers:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sudoers	Defaults logfile=/var/log/sudo.log

Require Re-Authentication When Using the sudo Command

Rule ID xccdf_org.ssgproject.content_rule_sudo_require_reauthentication

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sudo_require_reauthentication:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-004895
nist	IA-11
os-srg	SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158
cis	5.2.5, 5.2.6
pcidss4	2.2.6, 2.2

Description

The sudo timestamp_timeout tag sets the amount of time sudo password prompt waits. The default timestamp_timeout value is 5 minutes. The timestamp_timeout should be configured by making sure that the timestamp_timeout tag exists in /etc/sudoers configuration file or any sudo configuration snippets in /etc/sudoers.d/. If the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated.

Rationale

Without re-authentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.

OVAL test results details

check correct configuration in /etc/sudoers oval:ssg-test_sudo_timestamp_timeout:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sudoers	Defaults timestamp_timeout=5

check correct configuration in /etc/sudoers oval:ssg-test_sudo_timestamp_timeout_no_signs:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sudo_timestamp_timeout_no_signs:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\/etc\/(sudoers\|sudoers\.d\/.*)$	^[\s]Defaults[\s]+timestamp_timeout[\s]=\s[\-](\d\.\d+\|\d+\.\d*\|\d+)$	1

Ensure gpgcheck Enabled In Main dnf Configuration

Rule ID xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-ensure_gpgcheck_globally_activated:def:1

Time 2025-06-26T17:28:20+00:00

Severity high

References:

cis-csc	11, 2, 3, 9
cjis	5.10.4.1
cobit5	APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02
cui	3.4.8
disa	CCI-003992
hipaa	164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i)
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4
isa-62443-2013	SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6
iso27001-2013	A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4
nist	CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), SA-12, SA-12(10), CM-11(a), CM-11(b)
nist-csf	PR.DS-6, PR.DS-8, PR.IP-1
ospp	FPT_TUD_EXT.1, FPT_TUD_EXT.2
pcidss	Req-6.2
os-srg	SRG-OS-000366-GPOS-00153
anssi	R59
cis	1.2.1.2
pcidss4	6.3.3, 6.3

Description

The gpgcheck option controls whether RPM packages' signatures are always checked prior to installation. To configure dnf to check package signatures before installing them, ensure the following line appears in /etc/dnf/dnf.conf in the [main] section:

gpgcheck=1

Rationale

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.
Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.
Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA).

OVAL test results details

check value of gpgcheck in /etc/dnf/dnf.conf oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/dnf/dnf.conf	gpgcheck=1

Enable GNOME3 Login Warning Banner

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.9
disa	CCI-001387, CCI-001384, CCI-000048, CCI-001386, CCI-001388, CCI-001385
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	AC-8(a), AC-8(b), AC-8(c)
nist-csf	PR.AC-7
os-srg	SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
cis	1.8.2

Description

In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login screen by setting banner-message-enable to true.

To enable, add or edit banner-message-enable to /etc/dconf/db/distro.d/00-security-settings. For example:

[org/gnome/login-screen]
banner-message-enable=true

Once the setting has been added, add a lock to /etc/dconf/db/distro.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/login-screen/banner-message-enable

After the settings have been set, run dconf update. The banner text must also be set.

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.

Set the GNOME3 Login Warning Banner Text

Rule ID xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.9
disa	CCI-000048, CCI-001384, CCI-001385, CCI-001386, CCI-001387, CCI-001388
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	AC-8(a), AC-8(c)
nist-csf	PR.AC-7
os-srg	SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
cis	1.8.2

Description

In the default graphical environment, configuring the login warning banner text in the GNOME Display Manager's login screen can be configured on the login screen by setting banner-message-text to 'APPROVED_BANNER' where APPROVED_BANNER is the approved banner for your environment.

To enable, add or edit banner-message-text to /etc/dconf/db/distro.d/00-security-settings. For example:

[org/gnome/login-screen]
banner-message-text='APPROVED_BANNER'

Once the setting has been added, add a lock to /etc/dconf/db/distro.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/login-screen/banner-message-text

After the settings have been set, run dconf update. When entering a warning banner that spans several lines, remember to begin and end the string with ' and use \n for new lines.

Rationale

An appropriate warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers.

Ensure Local Login Warning Banner Is Configured Properly

Rule ID xccdf_org.ssgproject.content_rule_banner_etc_issue_cis

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-banner_etc_issue_cis:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.2

Description

To configure the system local login warning banner edit the /etc/issue file. The contents of this file is displayed to users prior to login to local terminals. Replace the default text with a message compliant with the local site policy. The message should not contain information about operating system version, release, kernel version or patch level. The recommended banner text can be tailored in the XCCDF Value xccdf_org.ssgproject.content_value_cis_banner_text:

Authorized users only. All activity may be monitored and reported.

Rationale

Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the uname -a command once they have logged in.

OVAL test results details

Check that the given object does not exist oval:ssg-test_banner_etc_issue_cis_file_nonempty:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/issue	Authorized users only. All activity may be monitored and reported.

Check that the given object does not exist oval:ssg-test_banner_etc_issue_cis:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_banner_etc_issue_cis:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/issue	(\\v\|\\r\|\\m\|\\s\|almalinux9)	1

Ensure Remote Login Warning Banner Is Configured Properly

Rule ID xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-banner_etc_issue_net_cis:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.3

Description

To configure the system remote login warning banner edit the /etc/issue.net file. The contents of this file is displayed to users prior to login from remote connections. Replace the default text with a message compliant with the local site policy. The message should not contain information about operating system version, release, kernel version or patch level. The recommended banner text can be tailored in the XCCDF Value xccdf_org.ssgproject.content_value_cis_banner_text:

Authorized users only. All activity may be monitored and reported.

Rationale

OVAL test results details

Check that the given object does not exist oval:ssg-test_banner_etc_issue_net_cis_file_nonempty:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/issue.net	Authorized users only. All activity may be monitored and reported.

Check that the given object does not exist oval:ssg-test_banner_etc_issue_net_cis:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_banner_etc_issue_net_cis:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/issue.net	(\\v\|\\r\|\\m\|\\s\|almalinux9)	1

Ensure Message Of The Day Is Configured Properly

Rule ID xccdf_org.ssgproject.content_rule_banner_etc_motd_cis

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-banner_etc_motd_cis:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.1

Description

To configure the system message of the day banner edit the /etc/motd file. Replace the default text with a message compliant with the local site policy. The message should not contain information about operating system version, release, kernel version or patch level. The recommended banner text can be tailored in the XCCDF Value xccdf_org.ssgproject.content_value_cis_banner_text:

Authorized users only. All activity may be monitored and reported.

Rationale

OVAL test results details

Check that the given object does not exist oval:ssg-test_banner_etc_motd_cis:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_banner_etc_motd_cis:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/motd	(\\v\|\\r\|\\m\|\\s\|almalinux9)	1

Verify Group Ownership of System Login Banner

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_etc_issue:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.5

Description

To properly set the group owner of /etc/issue, run the command:

$ sudo chgrp root /etc/issue

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper group ownership will ensure that only root user can modify the banner.

OVAL test results details

Testing group ownership of /etc/issue oval:ssg-test_file_groupowner_etc_issue_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_etc_issue_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/issue	oval:ssg-symlink_file_groupowner_etc_issue_uid_0:ste:1	oval:ssg-state_file_groupowner_etc_issue_gid_0_0:ste:1

Verify Group Ownership of System Login Banner for Remote Connections

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_etc_issue_net:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.6
pcidss4	1.2.8, 1.2

Description

To properly set the group owner of /etc/issue.net, run the command:

$ sudo chgrp root /etc/issue.net

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper group ownership will ensure that only root user can modify the banner.

OVAL test results details

Testing group ownership of /etc/issue.net oval:ssg-test_file_groupowner_etc_issue_net_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_etc_issue_net_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/issue.net	oval:ssg-symlink_file_groupowner_etc_issue_net_uid_0:ste:1	oval:ssg-state_file_groupowner_etc_issue_net_gid_0_0:ste:1

Verify Group Ownership of Message of the Day Banner

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_etc_motd:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.4

Description

To properly set the group owner of /etc/motd, run the command:

$ sudo chgrp root /etc/motd

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper group ownership will ensure that only root user can modify the banner.

OVAL test results details

Testing group ownership of /etc/motd oval:ssg-test_file_groupowner_etc_motd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_etc_motd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/motd	oval:ssg-symlink_file_groupowner_etc_motd_uid_0:ste:1	oval:ssg-state_file_groupowner_etc_motd_gid_0_0:ste:1

Verify ownership of System Login Banner

Rule ID xccdf_org.ssgproject.content_rule_file_owner_etc_issue

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_etc_issue:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.5

Description

To properly set the owner of /etc/issue, run the command:

$ sudo chown root /etc/issue

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper ownership will ensure that only root user can modify the banner.

OVAL test results details

Testing user ownership of /etc/issue oval:ssg-test_file_owner_etc_issue_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_etc_issue_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/issue	oval:ssg-symlink_file_owner_etc_issue_uid_0:ste:1	oval:ssg-state_file_owner_etc_issue_uid_0_0:ste:1

Verify ownership of System Login Banner for Remote Connections

Rule ID xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_etc_issue_net:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.6
pcidss4	1.2.8, 1.2

Description

To properly set the owner of /etc/issue.net, run the command:

$ sudo chown root /etc/issue.net

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper ownership will ensure that only root user can modify the banner.

OVAL test results details

Testing user ownership of /etc/issue.net oval:ssg-test_file_owner_etc_issue_net_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_etc_issue_net_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/issue.net	oval:ssg-symlink_file_owner_etc_issue_net_uid_0:ste:1	oval:ssg-state_file_owner_etc_issue_net_uid_0_0:ste:1

Verify ownership of Message of the Day Banner

Rule ID xccdf_org.ssgproject.content_rule_file_owner_etc_motd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_etc_motd:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.4

Description

To properly set the owner of /etc/motd, run the command:

$ sudo chown root /etc/motd

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper ownership will ensure that only root user can modify the banner.

OVAL test results details

Testing user ownership of /etc/motd oval:ssg-test_file_owner_etc_motd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_etc_motd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/motd	oval:ssg-symlink_file_owner_etc_motd_uid_0:ste:1	oval:ssg-state_file_owner_etc_motd_uid_0_0:ste:1

Verify permissions on System Login Banner

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_etc_issue

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_etc_issue:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.5

Description

To properly set the permissions of /etc/issue, run the command:

$ sudo chmod 0644 /etc/issue

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper permissions will ensure that only root user can modify the banner.

OVAL test results details

Testing mode of /etc/issue oval:ssg-test_file_permissions_etc_issue_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_etc_issue_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/issue	oval:ssg-exclude_symlinks__etc_issue:ste:1	oval:ssg-state_file_permissions_etc_issue_0_mode_0644or_stricter_:ste:1

Verify permissions on System Login Banner for Remote Connections

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_etc_issue_net:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.6
pcidss4	1.2.8, 1.2

Description

To properly set the permissions of /etc/issue.net, run the command:

$ sudo chmod 0644 /etc/issue.net

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper permissions will ensure that only root user can modify the banner.

OVAL test results details

Testing mode of /etc/issue.net oval:ssg-test_file_permissions_etc_issue_net_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_etc_issue_net_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/issue.net	oval:ssg-exclude_symlinks__etc_issue_net:ste:1	oval:ssg-state_file_permissions_etc_issue_net_0_mode_0644or_stricter_:ste:1

Verify permissions on Message of the Day Banner

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_etc_motd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_etc_motd:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	1.7.4

Description

To properly set the permissions of /etc/motd, run the command:

$ sudo chmod 0644 /etc/motd

Rationale

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Proper permissions will ensure that only root user can modify the banner.

OVAL test results details

Testing mode of /etc/motd oval:ssg-test_file_permissions_etc_motd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_etc_motd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/motd	oval:ssg-exclude_symlinks__etc_motd:ste:1	oval:ssg-state_file_permissions_etc_motd_0_mode_0644or_stricter_:ste:1

Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.

Rule ID

xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-account_password_pam_faillock_password_auth:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

disa	CCI-000044
nist	AC-7 (a)
os-srg	SRG-OS-000021-GPOS-00005
cis	5.3.2.2

Description

The pam_faillock.so module must be loaded in preauth in /etc/pam.d/password-auth.

Rationale

If the pam_faillock.so module is not loaded the system will not correctly lockout accounts to prevent password guessing attacks.

OVAL test results details

No more than one pam_unix.so is expected in auth section of password-auth oval:ssg-test_pam_faillock_password_auth_pam_unix_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/password-auth	auth sufficient pam_unix.so

One and only one occurrence is expected in auth section of password-auth oval:ssg-test_pam_faillock_password_auth_pam_faillock_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/password-auth	auth required pam_faillock.so preauth silent auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail

One and only one occurrence is expected in auth section of password-auth oval:ssg-test_pam_faillock_password_auth_pam_faillock_account:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/password-auth	account required pam_faillock.so account required pam_unix.so

Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.

Rule ID

xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-account_password_pam_faillock_system_auth:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

disa	CCI-000044
nist	AC-7 (a)
os-srg	SRG-OS-000021-GPOS-00005
cis	5.3.2.2

Description

The pam_faillock.so module must be loaded in preauth in /etc/pam.d/system-auth.

Rationale

If the pam_faillock.so module is not loaded the system will not correctly lockout accounts to prevent password guessing attacks.

OVAL test results details

No more than one pam_unix.so is expected in auth section of system-auth oval:ssg-test_pam_faillock_system_auth_pam_unix_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	auth sufficient pam_unix.so

One and only one occurrence is expected in auth section of system-auth oval:ssg-test_pam_faillock_system_auth_pam_faillock_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	auth required pam_faillock.so preauth silent auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail

One and only one occurrence is expected in auth section of system-auth oval:ssg-test_pam_faillock_system_auth_pam_faillock_account:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	account required pam_faillock.so account required pam_unix.so

Limit Password Reuse: password-auth

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.1.1
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.5.8
disa	CCI-000200
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(f), IA-5(1)(e)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.2.5
os-srg	SRG-OS-000077-GPOS-00045
cis	5.3.3.3.1
pcidss4	8.3.7, 8.3

Description

Do not allow users to reuse recent passwords. This can be accomplished by using the remember option for the pam_pwhistory PAM module.

On systems with newer versions of authselect, the pam_pwhistory PAM module can be enabled via authselect feature:

authselect enable-feature with-pwhistory

Otherwise, it should be enabled using an authselect custom profile.

Newer systems also have the /etc/security/pwhistory.conf file for setting pam_pwhistory module options. This file should be used whenever available. Otherwise, the pam_pwhistory module options can be set in PAM files.

The value for remember option must be equal or greater than 24

Rationale

Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.

Warnings

warning Newer versions of authselect contain an authselect feature to easily and properly enable pam_pwhistory.so module. If this feature is not yet available in your system, an authselect custom profile must be used to avoid integrity issues in PAM files. If a custom profile was created and used in the system before this authselect feature was available, the new feature can't be used with this custom profile and the remediation will fail. In this case, the custom profile should be recreated or manually updated.

OVAL test results details

Check pam_pwhistory.so presence in /etc/pam.d/password-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/password-auth	password requisite pam_pwhistory.so use_authtok

Check remember parameter is present and correct in /etc/pam.d/password-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_pamd:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_pamd:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

^\s*password\b.*\bpam_pwhistory\.so\b.*\bremember=([0-9]*).*$

/etc/pam.d/password-auth

Check the absence of remember parameter in /etc/security/pwhistory.conf oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_no_pwhistory_conf:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/security/pwhistory.conf	remember = 24

Check remember parameter is absent in /etc/pam.d/password-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_no_pamd:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_pamd:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\spassword\b.\bpam_pwhistory\.so\b.\bremember=([0-9]).*$	/etc/pam.d/password-auth	1

Check remember parameter is present and correct in /etc/security/pwhistory.conf oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_pwhistory_conf:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/pwhistory.conf	remember = 24

Limit Password Reuse: system-auth

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.1.1
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.5.8
disa	CCI-000200
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(f), IA-5(1)(e)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.2.5
os-srg	SRG-OS-000077-GPOS-00045
cis	5.3.3.3.1
pcidss4	8.3.7, 8.3

Description

authselect enable-feature with-pwhistory

Rationale

Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.

Warnings

OVAL test results details

Check pam_pwhistory.so presence in /etc/pam.d/system-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	password requisite pam_pwhistory.so use_authtok

Check remember parameter is present and correct in /etc/pam.d/system-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_pamd:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_pamd:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

^\s*password\b.*\bpam_pwhistory\.so\b.*\bremember=([0-9]*).*$

/etc/pam.d/system-auth

Check the absence of remember parameter in /etc/security/pwhistory.conf oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_no_pwhistory_conf:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/security/pwhistory.conf	remember = 24

Check remember parameter is absent in /etc/pam.d/system-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_no_pamd:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_pamd:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\spassword\b.\bpam_pwhistory\.so\b.\bremember=([0-9]).*$	/etc/pam.d/system-auth	1

Check remember parameter is present and correct in /etc/security/pwhistory.conf oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_pwhistory_conf:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/pwhistory.conf	remember = 24

Lock Accounts After Failed Password Attempts

Rule ID xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_passwords_pam_faillock_deny:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cjis	5.5.3
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.8
disa	CCI-000044, CCI-002238
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
ism	0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	CM-6(a), AC-7(a)
nist-csf	PR.AC-7
ospp	FIA_AFL.1
pcidss	Req-8.1.6
os-srg	SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
anssi	R31
cis	5.3.3.1.1
pcidss4	8.3.4, 8.3

Description

This rule configures the system to lock out accounts after a number of incorrect login attempts using pam_faillock.so. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. Ensure that the file /etc/security/faillock.conf contains the following entry: deny = <count> Where count should be less than or equal to 5 and greater than 0. In order to avoid errors when manually editing these files, it is recommended to use the appropriate tools, such as authselect or authconfig, depending on the OS version.

Rationale

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking the account.

Warnings

warning If the system relies on authselect tool to manage PAM settings, the remediation will also use authselect tool. However, if any manual modification was made in PAM files, the authselect integrity check will fail and the remediation will be aborted in order to preserve intentional changes. In this case, an informative message will be shown in the remediation report. If the system supports the /etc/security/faillock.conf file, the pam_faillock parameters should be defined in faillock.conf file.

OVAL test results details

no more that one pam_unix.so is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\s*auth\N+pam_unix\.so	/etc/pam.d/system-auth	1

no more that one pam_unix.so is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\s*auth\N+pam_unix\.so	/etc/pam.d/password-auth	1

One and only one occurrence is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	auth required pam_faillock.so preauth silent auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail

One and only one occurrence is expected in system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	account required pam_faillock.so account required pam_unix.so

One and only one occurrence is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/password-auth	auth required pam_faillock.so preauth silent auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail

One and only one occurrence is expected in password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/password-auth	account required pam_faillock.so account required pam_unix.so

Check the expected deny value in system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)

/etc/pam.d/system-auth

Check the expected deny value in password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)

/etc/pam.d/password-auth

Check the absence of deny parameter in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/security/faillock.conf	deny = 5

Check the absence of deny parameter in system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^[\s]auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]deny=([0-9]+)	/etc/pam.d/system-auth	1

Check the absence of deny parameter in password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^[\s]auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]deny=([0-9]+)	/etc/pam.d/password-auth	1

Check the expected deny value in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/faillock.conf	deny = 5

Set Lockout Time for Failed Password Attempts

Rule ID xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cjis	5.5.3
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.8
disa	CCI-000044, CCI-002238
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
ism	0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	CM-6(a), AC-7(b)
nist-csf	PR.AC-7
ospp	FIA_AFL.1
pcidss	Req-8.1.7
os-srg	SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005
anssi	R31
cis	5.3.3.1.2
pcidss4	8.3.4, 8.3

Description

This rule configures the system to lock out accounts during a specified time period after a number of incorrect login attempts using pam_faillock.so. Ensure that the file /etc/security/faillock.conf contains the following entry: unlock_time=<interval-in-seconds> where interval-in-seconds is 900 or greater. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as authselect or authconfig, depending on the OS version. If unlock_time is set to 0, manual intervention by an administrator is required to unlock a user. This should be done using the faillock tool.

Rationale

By limiting the number of failed logon attempts the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.

Warnings

warning If the system supports the new /etc/security/faillock.conf file but the pam_faillock.so parameters are defined directly in /etc/pam.d/system-auth and /etc/pam.d/password-auth, the remediation will migrate the unlock_time parameter to /etc/security/faillock.conf to ensure compatibility with authselect tool. The parameters deny and fail_interval, if used, also have to be migrated by their respective remediation.

OVAL test results details

no more that one pam_unix.so is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\s*auth\N+pam_unix\.so	/etc/pam.d/system-auth	1

no more that one pam_unix.so is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\s*auth\N+pam_unix\.so	/etc/pam.d/password-auth	1

One and only one occurrence is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	auth required pam_faillock.so preauth silent auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail

One and only one occurrence is expected in system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	account required pam_faillock.so account required pam_unix.so

One and only one occurrence is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/password-auth	auth required pam_faillock.so preauth silent auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail

One and only one occurrence is expected in password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/password-auth	account required pam_faillock.so account required pam_unix.so

Check the expected unlock_time value in system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

900

^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)

/etc/pam.d/system-auth

Check the expected unlock_time value in password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

900

^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)

/etc/pam.d/password-auth

Check the absence of unlock_time parameter in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/security/faillock.conf	unlock_time = 900

Check the absence of unlock_time parameter in system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^[\s]auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]unlock_time=([0-9]+)	/etc/pam.d/system-auth	1

Check the absence of unlock_time parameter in password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^[\s]auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]unlock_time=([0-9]+)	/etc/pam.d/password-auth	1

Check the expected unlock_time value in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/faillock.conf	unlock_time = 900

Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_pam_dictcheck:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-000366
nist	IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4)
os-srg	SRG-OS-000480-GPOS-00225, SRG-OS-000072-GPOS-00040
cis	5.3.3.2.6

Description

The pam_pwquality module's dictcheck check if passwords contains dictionary words. When dictcheck is set to 1 passwords will be checked for dictionary words.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Passwords with dictionary words may be more vulnerable to password-guessing attacks.

OVAL test results details

check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	password requisite pam_pwquality.so local_users_only

check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_dictcheck:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/pwquality.conf	dictcheck = 1

Ensure PAM Enforces Password Requirements - Minimum Different Characters

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_pam_difok

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_pam_difok:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.1.1
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
disa	CCI-004066
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(c), IA-5(1)(b), CM-6(a), IA-5(4)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
os-srg	SRG-OS-000072-GPOS-00040
cis	5.3.3.2.1

Description

The pam_pwquality module's difok parameter sets the number of characters in a password that must not be present in and old password during a password change.

Modify the difok setting in /etc/security/pwquality.conf to equal 2 to require differing characters when changing passwords.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute–force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however.

OVAL test results details

check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	password requisite pam_pwquality.so local_users_only

check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_difok:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/pwquality.conf	difok = 2

Ensure PAM Enforces Password Requirements - Enforce for root User

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_pam_enforce_root:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-004066
nist	IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4)
os-srg	SRG-OS-000072-GPOS-00040, SRG-OS-000071-GPOS-00039, SRG-OS-000070-GPOS-00038, SRG-OS-000266-GPOS-00101, SRG-OS-000078-GPOS-00046, SRG-OS-000480-GPOS-00225, SRG-OS-000069-GPOS-00037
cis	5.3.3.2.7

Description

The pam_pwquality module's enforce_for_root parameter controls requirements for enforcing password complexity for the root user. Enable the enforce_for_root setting in /etc/security/pwquality.conf to require the root user to use complex passwords.

Rationale

OVAL test results details

check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	password requisite pam_pwquality.so local_users_only

check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_enforce_for_root:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/security/pwquality.conf	enforce_for_root

Set Password Maximum Consecutive Repeating Characters

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_pam_maxrepeat:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
disa	CCI-004066
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(c), CM-6(a), IA-5(4)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
os-srg	SRG-OS-000072-GPOS-00040
cis	5.3.3.2.4

Description

The pam_pwquality module's maxrepeat parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Modify the maxrepeat setting in /etc/security/pwquality.conf to equal 3 to prevent a run of (3 + 1) or more identical characters.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.

OVAL test results details

check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	password requisite pam_pwquality.so local_users_only

check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/pwquality.conf	maxrepeat = 3

Ensure PAM Enforces Password Requirements - Minimum Different Categories

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_pam_minclass:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
disa	CCI-004066
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
ism	0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
os-srg	SRG-OS-000072-GPOS-00040
anssi	R68
cis	5.3.3.2.3

Description

The pam_pwquality module's minclass parameter controls requirements for usage of different character classes, or types, of character that must exist in a password before it is considered valid. For example, setting this value to three (3) requires that any password must have characters from at least three different categories in order to be approved. The default value is zero (0), meaning there are no required classes. There are four categories available:

* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)

Modify the minclass setting in /etc/security/pwquality.conf entry to require 4 differing categories of characters when changing passwords.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Requiring a minimum number of character categories makes password guessing attacks more difficult by ensuring a larger search space.

OVAL test results details

check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	password requisite pam_pwquality.so local_users_only

check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_minclass:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/pwquality.conf	minclass = 4

Ensure PAM Enforces Password Requirements - Minimum Length

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_pam_minlen:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.1.1
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
disa	CCI-004066
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
ism	0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
ospp	FMT_SMF_EXT.1
pcidss	Req-8.2.3
os-srg	SRG-OS-000078-GPOS-00046
anssi	R31, R68
cis	5.3.3.2.2
pcidss4	8.3.6, 8.3

Description

The pam_pwquality module's minlen parameter controls requirements for minimum characters required in a password. Add

minlen=14

after pam_pwquality to set minimum password length requirements.

Rationale

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.

OVAL test results details

check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	password requisite pam_pwquality.so local_users_only

check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_minlen:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/security/pwquality.conf	minlen = 14

Set Password Hashing Algorithm in /etc/libuser.conf

Rule ID xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-set_password_hashing_algorithm_libuserconf:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.2
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.13.11
disa	CCI-004062
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
ism	0418, 1055, 1402
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(c), IA-5(1)(c), CM-6(a)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.2.1
os-srg	SRG-OS-000073-GPOS-00041
cis	5.4.1.4
pcidss4	8.3.2, 8.3

Description

In /etc/libuser.conf, add or correct the following line in its [defaults] section to ensure the system will use the sha512 algorithm for password hashing:

crypt_style = sha512

Rationale

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text.

This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the crypt_style configuration option in /etc/libuser.conf ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.

OVAL test results details

check if /etc/libuser.conf hashing algorithm option is correct oval:ssg-test_set_password_hashing_algorithm_libuserconf:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/libuser.conf	crypt_style = sha512

Set Password Hashing Algorithm in /etc/login.defs

Rule ID xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-set_password_hashing_algorithm_logindefs:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.2
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.13.11
disa	CCI-004062
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
ism	0418, 1055, 1402
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(c), IA-5(1)(c), CM-6(a)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.2.1
os-srg	SRG-OS-000073-GPOS-00041
cis	5.4.1.4
pcidss4	8.3.2, 8.3

Description

In /etc/login.defs, add or update the following line to ensure the system will use SHA512 as the hashing algorithm:

ENCRYPT_METHOD SHA512

Rationale

OVAL test results details

The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs oval:ssg-test_set_password_hashing_algorithm_logindefs:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-variable_last_encrypt_method_instance_value:var:1	SHA512

Set PAM''s Password Hashing Algorithm - password-auth

Rule ID xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-set_password_hashing_algorithm_passwordauth:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.2
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.13.11
disa	CCI-004062
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
ism	0418, 1055, 1402
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(c), IA-5(1)(c), CM-6(a)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.2.1
os-srg	SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
cis	5.3.3.4.3

Description

The PAM system service can be configured to only store encrypted representations of passwords. In /etc/pam.d/password-auth, the password section of the file controls which PAM modules to execute during a password change. Set the pam_unix.so module in the password section to include the option sha512 and no other hashing algorithms as shown below:

password    sufficient    pam_unix.so sha512
          other arguments...

This will help ensure that new passwords for local users will be stored using the sha512 algorithm.

Rationale

Warnings

warning The hashing algorithms to be used with pam_unix.so are defined with independent module options. There are at least 7 possible algorithms and likely more algorithms will be introduced along the time. Due the the number of options and its possible combinations, the use of multiple hashing algorithm options may bring unexpected behaviors to the system. For this reason the check will pass only when one hashing algorithm option is defined and is aligned to the "var_password_hashing_algorithm_pam" variable. The remediation will ensure the correct option and remove any other extra hashing algorithm option.

OVAL test results details

check if pam_unix.so hashing algorithm option is correct and specified only once in /etc/pam.d/password-auth oval:ssg-test_set_password_hashing_algorithm_passwordauth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/pam.d/password-auth	password sufficient pam_unix.so sha512 shadow use_authtok

Set PAM''s Password Hashing Algorithm

Rule ID xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-set_password_hashing_algorithm_systemauth:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.2
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.13.11
disa	CCI-000196, CCI-000803, CCI-004062
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
ism	0418, 1055, 1402
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(c), IA-5(1)(c), CM-6(a)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.2.1
os-srg	SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
anssi	R68
cis	5.3.3.4.3
pcidss4	8.3.2, 8.3

Description

The PAM system service can be configured to only store encrypted representations of passwords. In "/etc/pam.d/system-auth", the password section of the file controls which PAM modules to execute during a password change. Set the pam_unix.so module in the password section to include the option sha512 and no other hashing algorithms as shown below:

password    sufficient    pam_unix.so sha512
          other arguments...

This will help ensure that new passwords for local users will be stored using the sha512 algorithm.

Rationale

Warnings

OVAL test results details

check if pam_unix.so hashing algorithm option is correct and specified only once in /etc/pam.d/system-auth oval:ssg-test_pam_unix_hashing_algorithm_systemauth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/pam.d/system-auth	password sufficient pam_unix.so sha512 shadow use_authtok

Install pam_pwquality Package

Rule ID xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_pam_pwquality_installed:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-000366
os-srg	SRG-OS-000480-GPOS-00225
cis	5.3.1.3

Description

The libpwquality package can be installed with the following command:

$ sudo dnf install libpwquality

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.

OVAL test results details

package libpwquality is installed oval:ssg-test_package_libpwquality_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	libpwquality	x86_64	(none)	8.el9	1.4.4	0:1.4.4-8.el9	d36cb86cb86b3716	libpwquality-0:1.4.4-8.el9.x86_64

Set Account Expiration Following Inactivity

Rule ID xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-account_disable_post_pw_expiration:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8
cjis	5.6.2.1.1
cobit5	DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.5.6
disa	CCI-003628, CCI-003627
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2
iso27001-2013	A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nerc-cip	CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3
nist	IA-4(e), AC-2(3), CM-6(a)
nist-csf	DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7
pcidss	Req-8.1.4
os-srg	SRG-OS-000118-GPOS-00060
cis	5.4.1.5
pcidss4	8.2.6, 8.2

Description

To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following line in /etc/default/useradd:

INACTIVE=45

If a password is currently on the verge of expiration, then 45 day(s) remain(s) until the account is automatically disabled. However, if the password will not expire for another 60 days, then 60 days plus 45 day(s) could elapse until the account would be automatically disabled. See the useradd man page for more information.

Rationale

Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.

OVAL test results details

the value INACTIVE parameter should be set appropriately in /etc/default/useradd oval:ssg-test_etc_default_useradd_inactive:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/default/useradd	INACTIVE=45

Ensure All Accounts on the System Have Unique Names

Rule ID

xccdf_org.ssgproject.content_rule_account_unique_name

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-account_unique_name:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

cjis	5.5.2
disa	CCI-000770, CCI-000804
pcidss	Req-8.1.1
cis	7.2.6
pcidss4	8.2.1, 8.2

Description

Ensure accounts on the system have unique names. To ensure all accounts have unique names, run the following command:

$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d

If a username is returned, change or delete the username.

Rationale

Unique usernames allow for accountability on the system.

OVAL test results details

There should not exist duplicate user name entries in /etc/passwd oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1	27

Set Password Maximum Age

Rule ID xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_maximum_age_login_defs:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.6.2.1
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.5.6
disa	CCI-004066
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
ism	0418, 1055, 1402
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(f), IA-5(1)(d), CM-6(a)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.2.4
os-srg	SRG-OS-000076-GPOS-00044
cis	5.4.1.1
pcidss4	8.3.9, 8.3

Description

To specify password maximum age for new accounts, edit the file /etc/login.defs and add or correct the following line:

PASS_MAX_DAYS 365

A value of 180 days is sufficient for many environments. The DoD requirement is 60. The profile requirement is 365.

Rationale

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.

OVAL test results details

The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs oval:ssg-test_pass_max_days:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-variable_last_pass_max_days_instance_value:var:1	365

Set Existing Passwords Maximum Age

Rule ID

xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-accounts_password_set_max_life_existing:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

disa	CCI-004066
nist	IA-5(f), IA-5(1)(d), CM-6(a)
os-srg	SRG-OS-000076-GPOS-00044
cis	5.4.1.1
pcidss4	8.3.9, 8.3

Description

Configure non-compliant accounts to enforce a 365-day maximum password lifetime restriction by running the following command:

$ sudo chage -M 365
          USER

Rationale

OVAL test results details

Compares a specific field in /etc/shadow with a specific variable value oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_test_accounts_password_set_max_life_existing_password_max_life_existing:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]:)(?:[^:]:){2}(\d+):(?:[^:]:){3}(?:[^:])$	1

Compares a specific field in /etc/shadow with a specific variable value oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]:)(?:[^:]:){2}(\d+):(?:[^:]:){3}(?:[^:])$	1

Passwords must have the maximum password age set non-empty in /etc/shadow. oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_not_empty:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_set_max_life_existing_shadow_password_users_max_life_not_existing:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]+:)(?:[^:]:){2}():(?:[^:]:){3}(?:[^:]*)$	1

Set Existing Passwords Warning Age

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_set_warn_age_existing:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-000198
nist	IA-5(f), IA-5(1)(d), CM-6(a)
cis	5.4.1.3
pcidss4	8.3.9, 8.3

Description

To configure how many days prior to password expiration that a warning will be issued to users, run the command:

$ sudo chage --warndays 7
          USER

The DoD requirement is 7, and CIS recommendation is no less than 7 days. This profile requirement is 7.

Rationale

Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may choose a simple password or write it down where it may be discovered.

OVAL test results details

Compares a specific field in /etc/shadow with a specific variable value oval:ssg-test_accounts_password_set_warn_age_existing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_test_accounts_password_set_warn_age_existing:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]:)(?:[^:]:){3}(\d+):(?:[^:]:){2}(?:[^:])$	1

Check the inexistence of users with a password defined oval:ssg-test_accounts_password_set_warn_age_existing_no_pass:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_set_warn_age_existing_no_pass:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]:)(?:[^:]:){3}(\d+):(?:[^:]:){2}(?:[^:])$	1

Set Password Warning Age

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_warn_age_login_defs:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8
cobit5	DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.5.8
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2
ism	0418, 1055, 1402
iso27001-2013	A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nist	IA-5(f), IA-5(1)(d), CM-6(a)
nist-csf	DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7
pcidss	Req-8.2.4
cis	5.4.1.3
pcidss4	8.3.9, 8.3

Description

To specify how many days prior to password expiration that a warning will be issued to users, edit the file /etc/login.defs and add or correct the following line:

PASS_WARN_AGE 7

The DoD requirement is 7. The profile requirement is 7.

Rationale

Setting the password warning age enables users to make the change at a practical time.

OVAL test results details

The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs oval:ssg-test_pass_warn_age:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-variable_last_pass_warn_age_instance_value:var:1	7

Set existing passwords a period of inactivity before they been locked

Rule ID

xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-accounts_set_post_pw_existing:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

cobit5	DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.5.6
disa	CCI-000017, CCI-000795, CCI-003627, CCI-003628
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2
iso27001-2013	A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nerc-cip	CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3
nist	IA-4(e), AC-2(3), CM-6(a)
nist-csf	DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7
pcidss	Req-8.1.4
os-srg	SRG-OS-000118-GPOS-00060
cis	5.4.1.5
pcidss4	8.2.6, 8.2

Description

Configure user accounts that have been inactive for over a given period of time to be automatically disabled by running the following command:

$ sudo chage --inactive 30USER

Rationale

Inactive accounts pose a threat to system security since the users are not logging in to notice failed login attempts or other anomalies.

OVAL test results details

Compares a specific field in /etc/shadow with a specific variable value oval:ssg-test_accounts_set_post_pw_existing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_test_accounts_set_post_pw_existing:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]:)(?:[^:]:){4}(\d+):(?:[^:]:)(?:[^:])$	1

Check the inexistence of users with a password defined oval:ssg-test_accounts_set_post_pw_existing_no_pass:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_set_post_pw_existing_no_pass:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]:)(?:[^:]:){4}(\d+):(?:[^:]:)(?:[^:])$	1

Verify All Account Password Hashes are Shadowed

Rule ID xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_password_all_shadowed:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.5.2
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.5.10
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
ism	1410
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	IA-5(h), CM-6(a)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.2.1
cis	7.2.1
pcidss4	8.3.2, 8.3

Description

If any password hashes are stored in /etc/passwd (in the second field, instead of an x or *), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely.

Rationale

The hashes for all user account passwords should be stored in the file /etc/shadow and never in /etc/passwd, which is readable by all users.

OVAL test results details

password hashes are shadowed oval:ssg-test_accounts_password_all_shadowed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Username	User id	Group id	Gcos	Home dir	Login shell	Last login
true	root	0	0	root	/root	/bin/bash	1750951437
true	rpcuser	29	29	RPC Service User	/var/lib/nfs	/sbin/nologin	-1
true	tcpdump	72	72		/	/sbin/nologin	-1
true	systemd-journal-remote	988	988	Journal Remote	/var/log/journal/remote	/sbin/nologin	-1
true	systemd-coredump	999	997	systemd Core Dumper	/	/sbin/nologin	-1
true	dbus	81	81	System message bus	/	/sbin/nologin	-1
true	ftp	14	50	FTP User	/var/ftp	/sbin/nologin	-1
true	nobody	65534	65534	Kernel Overflow User	/	/sbin/nologin	-1
true	tss	59	59	Account used for TPM access	/dev/null	/sbin/nologin	-1
true	sssd	998	995	User for sssd	/	/sbin/nologin	-1
true	chrony	997	994	chrony system user	/var/lib/chrony	/sbin/nologin	-1
true	sshd	74	74	Privilege-separated SSH	/usr/share/empty.sshd	/sbin/nologin	-1
true	systemd-oom	992	992	systemd Userspace OOM Killer	/	/usr/sbin/nologin	-1
true	polkitd	991	991	User for polkitd	/	/sbin/nologin	-1
true	rpc	32	32	Rpcbind Daemon	/var/lib/rpcbind	/sbin/nologin	-1
true	setroubleshoot	990	990	SELinux troubleshoot server	/var/lib/setroubleshoot	/sbin/nologin	-1
true	cockpit-ws	989	989	User for cockpit web service	/nonexisting	/sbin/nologin	-1
true	halt	7	0	halt	/sbin	/sbin/halt	-1
true	games	12	100	games	/usr/games	/sbin/nologin	-1
true	shutdown	6	0	shutdown	/sbin	/sbin/shutdown	-1
true	mail	8	12	mail	/var/spool/mail	/sbin/nologin	-1
true	operator	11	0	operator	/root	/sbin/nologin	-1
true	sync	5	0	sync	/sbin	/bin/sync	-1
true	lp	4	7	lp	/var/spool/lpd	/sbin/nologin	-1
true	adm	3	4	adm	/var/adm	/sbin/nologin	-1
true	daemon	2	2	daemon	/sbin	/sbin/nologin	-1
true	bin	1	1	bin	/bin	/sbin/nologin	-1

Ensure all users last password change date is in the past

Rule ID

xccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-accounts_password_last_change_is_in_past:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

cis	5.4.1.6
pcidss4	8.3.5, 8.3

Description

All users should have a password change date in the past.

Rationale

If a user recorded password change date is in the future then they could bypass any set password expiration.

Warnings

warning Automatic remediation is not available, in order to avoid any system disruption.

OVAL test results details

Check if the password last chage time is less than or equal today. oval:ssg-test_accounts_password_last_change_is_in_past:tst:1 unknown

Following items have been found on the system:

Result of item-state comparison	Var ref
unknown	oval:ssg-var_accounts_password_last_change_is_in_past_time_diff:var:1

Check the inexistence of users with a password defined oval:ssg-test_accounts_password_last_change_is_in_past_no_pass:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_last_change_is_in_past:obj:1 of type shadow_object

Username	Filter
.*	oval:ssg-state_accounts_password_all_chage_past_has_no_password:ste:1

All GIDs referenced in /etc/passwd must be defined in /etc/group

Rule ID

xccdf_org.ssgproject.content_rule_gid_passwd_group_same

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-gid_passwd_group_same:def:1

Time

2025-06-26T17:28:20+00:00

Severity

low

References:

cis-csc	1, 12, 15, 16, 5
cjis	5.5.2
cobit5	DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
disa	CCI-000764
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1
iso27001-2013	A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	IA-2, CM-6(a)
nist-csf	PR.AC-1, PR.AC-6, PR.AC-7
pcidss	Req-8.5.a
os-srg	SRG-OS-000104-GPOS-00051
cis	7.2.3
pcidss4	8.2.2, 8.2

Description

Add a group to the system for each GID referenced without a corresponding group.

Rationale

If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group with the Group Identifier (GID) is subsequently created, the user may have unintended rights to any files associated with the group.

OVAL test results details

Verify all GIDs referenced in /etc/passwd are defined in /etc/group oval:ssg-test_gid_passwd_group_same:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/passwd	halt:x:7:0:
true	/etc/passwd	mail:x:8:12:
true	/etc/passwd	operator:x:11:0:
true	/etc/passwd	games:x:12:100:
true	/etc/passwd	ftp:x:14:50:
true	/etc/passwd	nobody:x:65534:65534:
true	/etc/passwd	systemd-coredump:x:999:997:
true	/etc/passwd	dbus:x:81:81:
true	/etc/passwd	tss:x:59:59:
true	/etc/passwd	sssd:x:998:995:
true	/etc/passwd	chrony:x:997:994:
true	/etc/passwd	sshd:x:74:74:
true	/etc/passwd	root:x:0:0:
true	/etc/passwd	bin:x:1:1:
true	/etc/passwd	daemon:x:2:2:
true	/etc/passwd	adm:x:3:4:
true	/etc/passwd	lp:x:4:7:
true	/etc/passwd	sync:x:5:0:
true	/etc/passwd	shutdown:x:6:0:
true	/etc/passwd	systemd-oom:x:992:992:
true	/etc/passwd	polkitd:x:991:991:
true	/etc/passwd	rpc:x:32:32:
true	/etc/passwd	setroubleshoot:x:990:990:
true	/etc/passwd	cockpit-ws:x:989:989:
true	/etc/passwd	rpcuser:x:29:29:
true	/etc/passwd	tcpdump:x:72:72:
true	/etc/passwd	systemd-journal-remote:x:988:988:

Prevent Login to Accounts With Empty Password

Rule ID xccdf_org.ssgproject.content_rule_no_empty_passwords

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-no_empty_passwords:def:1

Time 2025-06-26T17:28:20+00:00

Severity high

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2
cobit5	APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10
cui	3.1.1, 3.1.5
disa	CCI-000366
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nist	IA-5(1)(a), IA-5(c), CM-6(a)
nist-csf	PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5
ospp	FIA_UAU.1
pcidss	Req-8.2.3
os-srg	SRG-OS-000480-GPOS-00227
cis	5.3.3.4.1
pcidss4	8.3.1, 8.3

Description

If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the nullok in /etc/pam.d/system-auth and /etc/pam.d/password-auth to prevent logins with empty passwords.

Rationale

If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Warnings

warning If the system relies on authselect tool to manage PAM settings, the remediation will also use authselect tool. However, if any manual modification was made in PAM files, the authselect integrity check will fail and the remediation will be aborted in order to preserve intentional changes. In this case, an informative message will be shown in the remediation report. Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway.

OVAL test results details

make sure nullok is not used in /etc/pam.d/system-auth oval:ssg-test_no_empty_passwords:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_no_empty_passwords:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^/etc/pam.d/(system\|password)-auth$	^[^#]\bnullok\b.$	1

Ensure There Are No Accounts With Blank or Null Passwords

Rule ID

xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-no_empty_passwords_etc_shadow:def:1

Time

2025-06-26T17:28:20+00:00

Severity

high

References:

disa	CCI-000366
nist	CM-6(b), CM-6.1(iv)
os-srg	SRG-OS-000480-GPOS-00227
cis	7.2.2
pcidss4	2.2.2, 2.2

Description

Check the "/etc/shadow" file for blank passwords with the following command:

$ sudo awk -F: '!$2 {print $1}' /etc/shadow

If the command returns any results, this is a finding. Configure all accounts on the system to have a password or lock the account with the following commands: Perform a password reset:

$ sudo passwd [username]

Lock an account:

$ sudo passwd -l [username]

Rationale

If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Warnings

warning Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway.

OVAL test results details

make sure there aren't blank or null passwords in /etc/shadow oval:ssg-test_no_empty_passwords_etc_shadow:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^[^:]+::.*$	1

Verify No .forward Files Exist

Rule ID xccdf_org.ssgproject.content_rule_no_forward_files

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-no_forward_files:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	7.2.9

Description

The .forward file specifies an email address to forward the user's mail to.

Rationale

Use of the .forward file poses a security risk in that sensitive data may be inadvertently transferred outside the organization. The .forward file also poses a risk as it can be used to execute commands that may perform unintended actions.

OVAL test results details

.forward files are not group or world accessible oval:ssg-test_accounts_users_home_forward_file_existance:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_users_home_forward_file_existance:obj:1 of type file_object

Path	Filename
Referenced variable has no values (oval:ssg-var_accounts_users_home_forward_file_existance_dirs:var	\.forward$

Verify No netrc Files Exist

Rule ID xccdf_org.ssgproject.content_rule_no_netrc_files

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-no_netrc_files:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis-csc	1, 11, 12, 14, 15, 16, 18, 3, 5
cobit5	DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10
disa	CCI-000196
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7
iso27001-2013	A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R1.3, CIP-003-8 R3, CIP-003-8 R3.1, CIP-003-8 R3.2, CIP-003-8 R3.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	IA-5(h), IA-5(1)(c), CM-6(a), IA-5(7)
nist-csf	PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.PT-3
cis	7.2.9

Description

The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any .netrc files should be removed.

Rationale

Unencrypted passwords for remote FTP servers may be stored in .netrc files.

OVAL test results details

look for .netrc in /home oval:ssg-test_no_netrc_files_home:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_no_netrc_files_home:obj:1 of type file_object

Behaviors	Path	Filename
no value	/home	^\.netrc$

Verify Only Root Has UID 0

Rule ID

xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-accounts_no_uid_except_zero:def:1

Time

2025-06-26T17:28:20+00:00

Severity

high

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10
cui	3.1.1, 3.1.5
disa	CCI-000366
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	IA-2, AC-6(5), IA-4(b)
nist-csf	PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5
pcidss	Req-8.5
os-srg	SRG-OS-000480-GPOS-00227
cis	5.4.2.1
pcidss4	8.2.1, 8.2

Description

If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed.
If the account is associated with system commands or applications the UID should be changed to one greater than "0" but less than "1000." Otherwise assign a UID greater than "1000" that has not already been assigned.

Rationale

An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.

OVAL test results details

test that there are no accounts with UID 0 except root in the /etc/passwd file oval:ssg-test_accounts_no_uid_except_root:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_no_uid_except_root:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/passwd	^(?!root:)[^:]:[^:]:0	1

Verify Root Has A Primary GID 0

Rule ID xccdf_org.ssgproject.content_rule_accounts_root_gid_zero

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_root_gid_zero:def:1

Time 2025-06-26T17:28:20+00:00

Severity high

References:

pcidss	Req-8.1.1
cis	5.4.2.2
pcidss4	8.2.1, 8.2

Description

The root user should have a primary group of 0.

Rationale

To help ensure that root-owned files are not inadvertently exposed to other users.

OVAL test results details

test that the root user has GID 0 in the /etc/passwd file oval:ssg-test_accounts_root_gid_zero:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/passwd	root:x:0:0:root:/root:/bin/bash

Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty

Rule ID xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-ensure_pam_wheel_group_empty:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

cis	5.2.7
pcidss4	2.2.6, 2.2

Description

Ensure that the group sugroup referenced by var_pam_wheel_group_for_su variable and used as value for the pam_wheel.so group option exists and has no members. This empty group used by pam_wheel.so in /etc/pam.d/su ensures that no user can run commands with altered privileges through the su command.

Rationale

The su program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such command is considered a good security practice.

Warnings

warning Note that this rule just ensures the group exists and has no members. This rule does not configure pam_wheel.so module. The pam_wheel.so module configuration is accomplished by use_pam_wheel_group_for_su rule.

OVAL test results details

check if group in var_pam_wheel_group_for_su variable used by pam_wheel.so exists oval:ssg-test_ensure_pam_wheel_group_empty_group_exists:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/group	sugroup:x:1000:

check if group defined by pam_wheel.so group option has no members oval:ssg-test_ensure_pam_wheel_group_empty_has_no_members:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/group	sugroup:x:1000:

Ensure Authentication Required for Single User Mode

Rule ID

xccdf_org.ssgproject.content_rule_ensure_root_password_configured

Result

fail

Multi-check rule

OVAL Definition ID

oval:ssg-ensure_root_password_configured:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

cis	5.4.2.4
pcidss4	2.2.2, 2.2

Description

Single user mode is used for recovery when the system detects an issue during boot or by manual selection from the bootloader.

Rationale

Requiring authentication in single user mode prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.

OVAL test results details

make sure root password is set in /etc/shadow oval:ssg-test_root_password_etc_shadow:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_root_password_etc_shadow:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^root:\$(y\|[0-9].+)\$.*$	1

Ensure that System Accounts Are Locked

Rule ID xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-no_password_auth_for_systemaccounts:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-6, CM-6(a)
cis	5.4.2.7
pcidss4	8.2.2, 8.2

Description

Some accounts are not associated with a human user of the system, and exist to perform some administrative functions. An attacker should not be able to log into these accounts.

System accounts are those user accounts with a user ID less than 1000. If any system account other than root, halt, sync, shutdown and nfsnobody has an unlocked password, disable it with the command:

$ sudo usermod -L account

Rationale

Disabling authentication for default system accounts makes it more difficult for attackers to make use of them to compromise a system.

OVAL test results details

system accounts with a password defined oval:ssg-test_no_password_auth_for_systemaccounts:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_no_password_auth_for_systemaccounts:obj:1 of type shadow_object

Username

Filter

rpcuser

tcpdump

systemd-journal-remote

systemd-coredump

dbus

ftp

tss

sssd

chrony

sshd

systemd-oom

polkitd

rpc

setroubleshoot

cockpit-ws

games

mail

operator

adm

daemon

bin

oval:ssg-filter_no_password_auth_for_systemaccounts_no_passwords_or_locked_accounts:ste:1

Ensure that System Accounts Do Not Run a Shell Upon Login

Rule ID xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-no_shelllogin_for_systemaccounts:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8
cobit5	DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS06.03
disa	CCI-000366
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2
ism	1491
iso27001-2013	A.12.4.1, A.12.4.3, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nist	AC-6, CM-6(a), CM-6(b), CM-6.1(iv)
nist-csf	DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6
os-srg	SRG-OS-000480-GPOS-00227
cis	5.4.2.7
pcidss4	8.2.2, 8.2

Description

Some accounts are not associated with a human user of the system, and exist to perform some administrative functions. Should an attacker be able to log into these accounts, they should not be granted access to a shell.

The login shell for each local account is stored in the last field of each line in /etc/passwd. System accounts are those user accounts with a user ID less than 1000. The user ID is stored in the third field. If any system account other than root has a login shell, disable it with the command:

$ sudo usermod -s /sbin/nologin account

Rationale

Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.

Warnings

warning Do not perform the steps in this section on the root account. Doing so might cause the system to become inaccessible.

OVAL test results details

SYS_UID_MIN not defined in /etc/login.defs oval:ssg-test_sys_uid_min_not_defined:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/login.defs	# # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # #FAIL_DELAY 3 # Currently FAILLOG_ENAB is not supported # # Enable display of unknown usernames when login(1) failures are recorded. # #LOG_UNKFAIL_ENAB no # Currently LOG_OK_LOGINS is not supported # Currently LASTLOG_ENAB is not supported # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # Currently MAIL_CHECK_ENAB is not supported # Currently OBSCURE_CHECKS_ENAB is not supported # Currently PORTTIME_CHECKS_ENAB is not supported # Currently QUOTAS_ENAB is not supported # Currently SYSLOG_SU_ENAB is not supported # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # #SYSLOG_SG_ENAB yes # Currently CONSOLE is not supported # Currently SULOG_FILE is not supported # Currently MOTD_FILE is not supported # Currently ISSUE_FILE is not supported # Currently TTYTYPE_FILE is not supported # Currently FTMP_FILE is not supported # Currently NOLOGINS_FILE is not supported # Currently SU_NAME is not supported # REQUIRED # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # MAIL_DIR /var/spool/mail #MAIL_FILE .mail # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # Currently ENV_TZ is not supported # Currently ENV_HZ is not supported # # The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) #ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin #ENV_PATH PATH=/bin:/usr/bin # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # #TTYGROUP tty #TTYPERM 0600 # Currently ERASECHAR, KILLCHAR and ULIMIT are not supported # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 027 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 365 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # Currently PASS_MIN_LEN is not supported # Currently SU_WHEEL_ONLY is not supported # Currently CRACKLIB_DICTPATH is not supported # # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 UID_MAX 60000 # System accounts SYS_UID_MIN 201

SYS_UID_MAX not defined in /etc/login.defs oval:ssg-test_sys_uid_max_not_defined:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/login.defs	# # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # #FAIL_DELAY 3 # Currently FAILLOG_ENAB is not supported # # Enable display of unknown usernames when login(1) failures are recorded. # #LOG_UNKFAIL_ENAB no # Currently LOG_OK_LOGINS is not supported # Currently LASTLOG_ENAB is not supported # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # Currently MAIL_CHECK_ENAB is not supported # Currently OBSCURE_CHECKS_ENAB is not supported # Currently PORTTIME_CHECKS_ENAB is not supported # Currently QUOTAS_ENAB is not supported # Currently SYSLOG_SU_ENAB is not supported # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # #SYSLOG_SG_ENAB yes # Currently CONSOLE is not supported # Currently SULOG_FILE is not supported # Currently MOTD_FILE is not supported # Currently ISSUE_FILE is not supported # Currently TTYTYPE_FILE is not supported # Currently FTMP_FILE is not supported # Currently NOLOGINS_FILE is not supported # Currently SU_NAME is not supported # REQUIRED # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # MAIL_DIR /var/spool/mail #MAIL_FILE .mail # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # Currently ENV_TZ is not supported # Currently ENV_HZ is not supported # # The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) #ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin #ENV_PATH PATH=/bin:/usr/bin # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # #TTYGROUP tty #TTYPERM 0600 # Currently ERASECHAR, KILLCHAR and ULIMIT are not supported # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 027 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 365 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # Currently PASS_MIN_LEN is not supported # Currently SU_WHEEL_ONLY is not supported # Currently CRACKLIB_DICTPATH is not supported # # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 UID_MAX 60000 # System accounts SYS_UID_MIN 201 SYS_UID_MAX 999

<0, UID_MIN - 1> system UIDs having shell set oval:ssg-test_shell_defined_default_uid_range:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_etc_passwd_entries:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/passwd	^(?!root).:x:([\d]+):[\d]+:[^:]:[^:]:(?!\/usr\/sbin\/nologin\|\/sbin\/nologin\|\/bin\/sync\|\/sbin\/shutdown\|\/sbin\/halt).$	1

SYS_UID_MIN not defined in /etc/login.defs oval:ssg-test_sys_uid_min_not_defined:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/login.defs	# # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # #FAIL_DELAY 3 # Currently FAILLOG_ENAB is not supported # # Enable display of unknown usernames when login(1) failures are recorded. # #LOG_UNKFAIL_ENAB no # Currently LOG_OK_LOGINS is not supported # Currently LASTLOG_ENAB is not supported # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # Currently MAIL_CHECK_ENAB is not supported # Currently OBSCURE_CHECKS_ENAB is not supported # Currently PORTTIME_CHECKS_ENAB is not supported # Currently QUOTAS_ENAB is not supported # Currently SYSLOG_SU_ENAB is not supported # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # #SYSLOG_SG_ENAB yes # Currently CONSOLE is not supported # Currently SULOG_FILE is not supported # Currently MOTD_FILE is not supported # Currently ISSUE_FILE is not supported # Currently TTYTYPE_FILE is not supported # Currently FTMP_FILE is not supported # Currently NOLOGINS_FILE is not supported # Currently SU_NAME is not supported # REQUIRED # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # MAIL_DIR /var/spool/mail #MAIL_FILE .mail # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # Currently ENV_TZ is not supported # Currently ENV_HZ is not supported # # The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) #ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin #ENV_PATH PATH=/bin:/usr/bin # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # #TTYGROUP tty #TTYPERM 0600 # Currently ERASECHAR, KILLCHAR and ULIMIT are not supported # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 027 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 365 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # Currently PASS_MIN_LEN is not supported # Currently SU_WHEEL_ONLY is not supported # Currently CRACKLIB_DICTPATH is not supported # # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 UID_MAX 60000 # System accounts SYS_UID_MIN 201

SYS_UID_MAX not defined in /etc/login.defs oval:ssg-test_sys_uid_max_not_defined:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/login.defs	# # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # #FAIL_DELAY 3 # Currently FAILLOG_ENAB is not supported # # Enable display of unknown usernames when login(1) failures are recorded. # #LOG_UNKFAIL_ENAB no # Currently LOG_OK_LOGINS is not supported # Currently LASTLOG_ENAB is not supported # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # Currently MAIL_CHECK_ENAB is not supported # Currently OBSCURE_CHECKS_ENAB is not supported # Currently PORTTIME_CHECKS_ENAB is not supported # Currently QUOTAS_ENAB is not supported # Currently SYSLOG_SU_ENAB is not supported # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # #SYSLOG_SG_ENAB yes # Currently CONSOLE is not supported # Currently SULOG_FILE is not supported # Currently MOTD_FILE is not supported # Currently ISSUE_FILE is not supported # Currently TTYTYPE_FILE is not supported # Currently FTMP_FILE is not supported # Currently NOLOGINS_FILE is not supported # Currently SU_NAME is not supported # REQUIRED # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # MAIL_DIR /var/spool/mail #MAIL_FILE .mail # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # Currently ENV_TZ is not supported # Currently ENV_HZ is not supported # # The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) #ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin #ENV_PATH PATH=/bin:/usr/bin # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # #TTYGROUP tty #TTYPERM 0600 # Currently ERASECHAR, KILLCHAR and ULIMIT are not supported # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 027 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 365 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # Currently PASS_MIN_LEN is not supported # Currently SU_WHEEL_ONLY is not supported # Currently CRACKLIB_DICTPATH is not supported # # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 UID_MAX 60000 # System accounts SYS_UID_MIN 201 SYS_UID_MAX 999

<0, SYS_UID_MIN> system UIDs having shell set oval:ssg-test_shell_defined_reserved_uid_range:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_etc_passwd_entries:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/passwd	^(?!root).:x:([\d]+):[\d]+:[^:]:[^:]:(?!\/usr\/sbin\/nologin\|\/sbin\/nologin\|\/bin\/sync\|\/sbin\/shutdown\|\/sbin\/halt).$	1

<SYS_UID_MIN, SYS_UID_MAX> system UIDS having shell set oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_etc_passwd_entries:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/passwd	^(?!root).:x:([\d]+):[\d]+:[^:]:[^:]:(?!\/usr\/sbin\/nologin\|\/sbin\/nologin\|\/bin\/sync\|\/sbin\/shutdown\|\/sbin\/halt).$	1

Enforce Usage of pam_wheel with Group Parameter for su Authentication

Rule ID xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-use_pam_wheel_group_for_su:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis	5.2.7
pcidss4	2.2.6, 2.2

Description

To ensure that only users who are members of the group set in the group option of pam_wheel.so module can run commands with altered privileges through the su command, make sure that the following line exists in the file /etc/pam.d/su:

auth required pam_wheel.so use_uid group=sugroup

Rationale

Warnings

warning Note that ensure_pam_wheel_group_empty rule complements this requirement by ensuring the referenced group exists and has no members.

OVAL test results details

check /etc/pam.d/su for correct setting oval:ssg-test_use_pam_wheel_group_for_su:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/pam.d/su	auth required pam_wheel.so use_uid group=sugroup

Ensure All Accounts on the System Have Unique User IDs

Rule ID

xccdf_org.ssgproject.content_rule_account_unique_id

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-account_unique_id:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

disa	CCI-000135, CCI-000764, CCI-000804
pcidss	Req-8.1.1
os-srg	SRG-OS-000104-GPOS-00051, SRG-OS-000121-GPOS-00062
cis	7.2.4
pcidss4	8.2.1, 8.2

Description

Change user IDs (UIDs), or delete accounts, so each has a unique name.

Rationale

To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.

Warnings

warning Automatic remediation of this control is not available due to unique requirements of each system.

OVAL test results details

There should not exist duplicate user ids in /etc/passwd oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-variable_count_of_all_uids:var:1	27

Ensure All Groups on the System Have Unique Group ID

Rule ID

xccdf_org.ssgproject.content_rule_group_unique_id

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-group_unique_id:def:1

Time

2025-06-26T17:28:20+00:00

Severity

medium

References:

disa	CCI-000764
os-srg	SRG-OS-000104-GPOS-00051
cis	7.2.5
pcidss4	8.2.1, 8.2

Description

Change the group name or delete groups, so each has a unique id.

Rationale

To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.

Warnings

warning Automatic remediation of this control is not available due to the unique requirements of each system.

OVAL test results details

There should not exist duplicate group ids in /etc/passwd oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-variable_count_of_all_group_ids:var:1	47

Ensure that Root's Path Does Not Include World or Group-Writable Directories

Rule ID

xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-accounts_root_path_dirs_no_write:def:1

Time

2025-06-26T17:28:21+00:00

Severity

medium

References:

cis-csc	11, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05
disa	CCI-000366
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4
nist	CM-6(a), CM-6(a)
nist-csf	PR.IP-1
cis	5.4.2.5

Description

For each element in root's path, run:

# ls -ld DIR

and ensure that write permissions are disabled for group and other.

Rationale

Such entries increase the risk that root could execute code provided by unprivileged users, and potentially malicious code.

OVAL test results details

Check if there aren't directories in root's path having write permission set for group or other oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1 of type file_object

Path

Filename

Filter

/sbin

/bin

/usr/sbin

/usr/bin

no value

oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1

oval:ssg-state_accounts_root_path_dirs_symlink:ste:1

Ensure that Root's Path Does Not Include Relative Paths or Null Directories

Rule ID xccdf_org.ssgproject.content_rule_root_path_no_dot

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-root_path_no_dot:def:1

Time 2025-06-26T17:28:21+00:00

Severity unknown

References:

cis-csc	11, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05
disa	CCI-000366
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4
nist	CM-6(a), CM-6(a)
nist-csf	PR.IP-1
cis	5.4.2.5

Description

Ensure that none of the directories in root's path is equal to a single . character, or that it contains any instances that lead to relative path traversal, such as .. or beginning a path without the slash (/) character. Also ensure that there are no "empty" elements in the path, such as in these examples:

PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin

These empty elements have the same effect as a single . character.

Rationale

Including these entries increases the risk that root could execute code from an untrusted location.

OVAL test results details

environment variable PATH starts with : or . oval:ssg-test_env_var_begins:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Pid	Name	Value
false	59936	PATH	/sbin:/bin:/usr/sbin:/usr/bin

environment variable PATH doesn't contain : twice in a row oval:ssg-test_env_var_contains_doublecolon:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Pid	Name	Value
false	59936	PATH	/sbin:/bin:/usr/sbin:/usr/bin

environment variable PATH doesn't contain . twice in a row oval:ssg-test_env_var_contains_doubleperiod:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Pid	Name	Value
false	59936	PATH	/sbin:/bin:/usr/sbin:/usr/bin

environment variable PATH ends with : or . oval:ssg-test_env_var_ends:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Pid	Name	Value
false	59936	PATH	/sbin:/bin:/usr/sbin:/usr/bin

environment variable PATH starts with an absolute path / oval:ssg-test_env_var_begins_slash:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Pid	Name	Value
false	59936	PATH	/sbin:/bin:/usr/sbin:/usr/bin

environment variable PATH contains relative paths oval:ssg-test_env_var_contains_relative_path:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Pid	Name	Value
false	59936	PATH	/sbin:/bin:/usr/sbin:/usr/bin

Ensure the Default Bash Umask is Set Correctly

Rule ID xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_umask_etc_bashrc:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	18
cobit5	APO13.01, BAI03.01, BAI03.02, BAI03.03
disa	CCI-000366
isa-62443-2009	4.3.4.3.3
iso27001-2013	A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-6(1), CM-6(a)
nist-csf	PR.IP-2
os-srg	SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00227
anssi	R36
cis	5.4.3.3

Description

To ensure the default umask for users of the Bash shell is set properly, add or correct the umask setting in /etc/bashrc to read as follows:

umask 027

Rationale

The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

OVAL test results details

Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
not evaluated	oval:ssg-var_accounts_user_umask_umask_as_number:var:1	23

Test the retrieved /etc/bashrc umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_bashrc:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-var_etc_bashrc_umask_as_number:var:1	23

Ensure the Default Umask is Set Correctly in login.defs

Rule ID xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_umask_etc_login_defs:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	11, 18, 3, 9
cobit5	APO13.01, BAI03.01, BAI03.02, BAI03.03, BAI10.01, BAI10.02, BAI10.03, BAI10.05
disa	CCI-000366
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.1.1, A.14.2.1, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.5, A.6.1.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-6(1), CM-6(a)
nist-csf	PR.IP-1, PR.IP-2
os-srg	SRG-OS-000480-GPOS-00228
anssi	R36
cis	5.4.3.3

Description

To ensure the default umask controlled by /etc/login.defs is set properly, add or correct the UMASK setting in /etc/login.defs to read as follows:

UMASK 027

Rationale

OVAL test results details

Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
not evaluated	oval:ssg-var_accounts_user_umask_umask_as_number:var:1	23

Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_login_defs:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-var_etc_login_defs_umask_as_number:var:1	23

Ensure the Default Umask is Set Correctly in /etc/profile

Rule ID xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_umask_etc_profile:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	18
cobit5	APO13.01, BAI03.01, BAI03.02, BAI03.03
disa	CCI-000366
isa-62443-2009	4.3.4.3.3
iso27001-2013	A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-6(1), CM-6(a)
nist-csf	PR.IP-2
os-srg	SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00227
anssi	R36
cis	5.4.3.3

Description

To ensure the default umask controlled by /etc/profile is set properly, add or correct the umask setting in /etc/profile to read as follows:

umask 027

Note that /etc/profile also reads scrips within /etc/profile.d directory. These scripts are also valid files to set umask value. Therefore, they should also be considered during the check and properly remediated, if necessary.

Rationale

OVAL test results details

Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
not evaluated	oval:ssg-var_accounts_user_umask_umask_as_number:var:1	23

umask value(s) from profile configuration files match the requirement oval:ssg-tst_accounts_umask_etc_profile:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-var_etc_profile_umask_as_number:var:1	23

Set Interactive Session Timeout

Rule ID xccdf_org.ssgproject.content_rule_accounts_tmout

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_tmout:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.11
disa	CCI-000057, CCI-001133
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nerc-cip	CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	AC-12, SC-10, AC-2(5), CM-6(a)
nist-csf	PR.AC-7
os-srg	SRG-OS-000163-GPOS-00072, SRG-OS-000029-GPOS-00010
anssi	R32
cis	5.4.3.2
pcidss4	8.6.1, 8.6

Description

Setting the TMOUT option in /etc/profile ensures that all user sessions will terminate based on inactivity. The value of TMOUT should be exported and read only. The TMOUT setting in a file loaded by /etc/profile, e.g. /etc/profile.d/tmout.sh should read as follows:

typeset -xr TMOUT=900

declare -xr TMOUT=900

Using the typeset keyword is preferred for wider compatibility with ksh and other shells.

Rationale

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.

OVAL test results details

TMOUT in /etc/profile oval:ssg-test_etc_profile_tmout:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_etc_profile_tmout:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/profile	^[\s](?:typeset\|declare)[\s]+-xr[\s]+TMOUT=([\w$]+).$	1

TMOUT in /etc/profile.d/*.sh oval:ssg-test_etc_profiled_tmout:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/profile.d/tmout.sh	typeset -xr TMOUT=900

Check that at least one TMOUT is defined oval:ssg-test_accounts_tmout_defined:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-variable_count_of_tmout_instances:var:1	1

User Initialization Files Must Be Group-Owned By The Primary Group

Rule ID

xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-accounts_user_dot_group_ownership:def:1

Time

2025-06-26T17:28:21+00:00

Severity

medium

References:

disa	CCI-000366
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.2.9

Description

Change the group owner of interactive users files to the group found in

/etc/passwd

for the user. To change the group owner of a local interactive user home directory, use the following command:

$ sudo chgrp USER_GROUP /home/USER/.INIT_FILE

This rule ensures every initialization file related to an interactive user is group-owned by an interactive user.

Rationale

Local initialization files for interactive users are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.

Warnings

warning Due to OVAL limitation, this rule can report a false negative in a specific situation where two interactive users swap the group-ownership of their respective initialization files.

OVAL test results details

All user initialization files are group-owned by a local interactive user oval:ssg-test_accounts_user_dot_group_ownership:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_user_dot_group_ownership_init_files:obj:1 of type file_object

Behaviors	Path	Filename
Referenced variable has no values (oval:ssg-var_accounts_user_dot_group_ownership_dirs:var:1).	no value	^\..*

User Initialization Files Must Not Run World-Writable Programs

Rule ID

xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-accounts_user_dot_no_world_writable_programs:def:1

Time

2025-06-26T17:28:21+00:00

Severity

medium

References:

disa	CCI-000366
os-srg	SRG-OS-000480-GPOS-00227
cis	7.2.9

Description

Set the mode on files being executed by the user initialization files with the following command:

$ sudo chmod o-w FILE

Rationale

If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.

OVAL test results details

Init files do not execute world-writable programs oval:ssg-test_accounts_user_dot_no_world_writable_programs:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_user_dot_no_world_writable_programs_init_files:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
^\.[\w\- ]+$Referenced variable has no values (oval:ssg-var_accounts_user_dot_no_world_writable_programs_dirs:v	1

User Initialization Files Must Be Owned By the Primary User

Rule ID

xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-accounts_user_dot_user_ownership:def:1

Time

2025-06-26T17:28:21+00:00

Severity

medium

References:

disa	CCI-000366
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.2.9

Description

Set the owner of the user initialization files for interactive users to the primary owner with the following command:

$ sudo chown USER /home/USER/.*

This rule ensures every initialization file related to an interactive user is owned by an interactive user.

Rationale

Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.

Warnings

warning Due to OVAL limitation, this rule can report a false negative in a specific situation where two interactive users swap the ownership of their respective initialization files.

OVAL test results details

All user initialization files are owned by a local interactive user oval:ssg-test_accounts_user_dot_user_ownership:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_user_dot_user_ownership_init_files:obj:1 of type file_object

Behaviors	Path	Filename
Referenced variable has no values (oval:ssg-var_accounts_user_dot_user_ownership_dirs:var:1).	no value	^\..*

All Interactive Users Home Directories Must Exist

Rule ID xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-accounts_user_interactive_home_directory_exists:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

disa	CCI-000366
os-srg	SRG-OS-000480-GPOS-00227
cis	7.2.8

Description

Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in /etc/passwd:

$ sudo mkdir /home/USER

Rationale

If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.

OVAL test results details

Check the existence of interactive users. oval:ssg-test_accounts_user_interactive_home_directory_exists:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_user_interactive_home_directory_exists_dirs_count_fs:obj:1 of type variable_object

Var ref
oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count_fs:var:1

Check the existence of interactive users. oval:ssg-test_accounts_user_interactive_home_directory_exists_users:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_user_interactive_home_directory_exists_dirs_count_pw:obj:1 of type variable_object

Var ref
oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count:var:1

Ensure All User Initialization Files Have Mode 0740 Or Less Permissive

Rule ID xccdf_org.ssgproject.content_rule_file_permission_user_init_files

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permission_user_init_files:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

disa	CCI-000366
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.2.9

Description

Set the mode of the user initialization files to 0740 with the following command:

$ sudo chmod 0740 /home/USER/.INIT_FILE

Rationale

Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.

OVAL test results details

Init files have mode 0740 or less permissive oval:ssg-test_file_permission_user_init_files:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permission_user_init_files:obj:1 of type file_object

Path	Filename
^\.[\w\- ]+$Referenced variable has no values (oval:ssg-var_file_permission_user_init_files_home_dirs:var:1).

All Interactive User Home Directories Must Have mode 0750 Or Less Permissive

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_home_directories

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_home_directories:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

disa	CCI-000366
os-srg	SRG-OS-000480-GPOS-00227
cis	7.2.8

Description

Change the mode of interactive users home directories to 0750. To change the mode of interactive users home directory, use the following command:

$ sudo chmod 0750 /home/USER

Rationale

Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.

OVAL test results details

All home directories have proper permissions oval:ssg-test_file_permissions_home_directories:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_home_directories_dirs:obj:1 of type file_object

Path	Filename
Referenced variable has no values (oval:ssg-var_file_permissions_home_directories_dirs:var:1).	no value

Enable authselect

Rule ID xccdf_org.ssgproject.content_rule_enable_authselect

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-enable_authselect:def:1

Time 2025-06-26T17:28:20+00:00

Severity medium

References:

disa	CCI-000213
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
nist	AC-3
ospp	FIA_UAU.1, FIA_AFL.1
os-srg	SRG-OS-000480-GPOS-00227
anssi	R31
cis	enable_authselect
pcidss4	8.3.4, 8.3

Description

Configure user authentication setup to use the authselect tool. If authselect profile is selected, the rule will enable the sssd profile.

Rationale

Authselect is a successor to authconfig. It is a tool to select system authentication and identity sources from a list of supported profiles instead of letting the administrator manually build the PAM stack. That way, it avoids potential breakage of configuration, as it ships several tested profiles that are well tested and supported to solve different use-cases.

Warnings

warning If the sudo authselect select command returns an error informing that the chosen profile cannot be selected, it is probably because PAM files have already been modified by the administrator. If this is the case, in order to not overwrite the desired changes made by the administrator, the current PAM settings should be investigated before forcing the selection of the chosen authselect profile.

OVAL test results details

The 'fingerprint-auth' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_fingerprint_symlinked_to_authselect:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Filepath	Canonical path
true	/etc/pam.d/fingerprint-auth	/etc/authselect/fingerprint-auth

The 'password-auth' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_password_symlinked_to_authselect:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Filepath	Canonical path
true	/etc/pam.d/password-auth	/etc/authselect/password-auth

The 'postlogin' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_postlogin_symlinked_to_authselect:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Filepath	Canonical path
true	/etc/pam.d/postlogin	/etc/authselect/postlogin

The 'smartcard-auth' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_smartcard_symlinked_to_authselect:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Filepath	Canonical path
true	/etc/pam.d/smartcard-auth	/etc/authselect/smartcard-auth

The 'system-auth' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_system_symlinked_to_authselect:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Filepath	Canonical path
true	/etc/pam.d/system-auth	/etc/authselect/system-auth

Verify /boot/grub2/grub.cfg Group Ownership

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_grub2_cfg:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
cui	3.4.5
disa	CCI-000366
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-7.1
os-srg	SRG-OS-000480-GPOS-00227
anssi	R29
cis	1.4.2
pcidss4	2.2.6, 2.2

Description

The file /boot/grub2/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. To properly set the group owner of /boot/grub2/grub.cfg, run the command:

$ sudo chgrp root /boot/grub2/grub.cfg

Rationale

The root group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.

OVAL test results details

Testing group ownership of /boot/grub2/grub.cfg oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_grub2_cfg_0:obj:1 of type file_object

Filepath	Filter	Filter
/boot/grub2/grub.cfg	oval:ssg-symlink_file_groupowner_grub2_cfg_uid_0:ste:1	oval:ssg-state_file_groupowner_grub2_cfg_gid_0_0:ste:1

Verify /boot/grub2/user.cfg Group Ownership

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_user_cfg:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
cui	3.4.5
disa	CCI-000225
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-7.1
os-srg	SRG-OS-000480-GPOS-00227
anssi	R29
cis	1.4.2
pcidss4	2.2.6, 2.2

Description

The file /boot/grub2/user.cfg should be group-owned by the root group to prevent reading or modification of the file. To properly set the group owner of /boot/grub2/user.cfg, run the command:

$ sudo chgrp root /boot/grub2/user.cfg

Rationale

The root group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.

OVAL test results details

Testing group ownership of /boot/grub2/user.cfg oval:ssg-test_file_groupowner_user_cfg_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_user_cfg_0:obj:1 of type file_object

Filepath	Filter	Filter
/boot/grub2/user.cfg	oval:ssg-symlink_file_groupowner_user_cfg_uid_0:ste:1	oval:ssg-state_file_groupowner_user_cfg_gid_0_0:ste:1

Verify /boot/grub2/grub.cfg User Ownership

Rule ID xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_grub2_cfg:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
cui	3.4.5
disa	CCI-000366
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-7.1
os-srg	SRG-OS-000480-GPOS-00227
anssi	R29
cis	1.4.2
pcidss4	2.2.6, 2.2

Description

The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. To properly set the owner of /boot/grub2/grub.cfg, run the command:

$ sudo chown root /boot/grub2/grub.cfg

Rationale

Only root should be able to modify important boot parameters.

OVAL test results details

Testing user ownership of /boot/grub2/grub.cfg oval:ssg-test_file_owner_grub2_cfg_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_grub2_cfg_0:obj:1 of type file_object

Filepath	Filter	Filter
/boot/grub2/grub.cfg	oval:ssg-symlink_file_owner_grub2_cfg_uid_0:ste:1	oval:ssg-state_file_owner_grub2_cfg_uid_0_0:ste:1

Verify /boot/grub2/user.cfg User Ownership

Rule ID xccdf_org.ssgproject.content_rule_file_owner_user_cfg

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_user_cfg:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
cui	3.4.5
disa	CCI-000225
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-7.1
anssi	R29
cis	1.4.2
pcidss4	2.2.6, 2.2

Description

The file /boot/grub2/user.cfg should be owned by the root user to prevent reading or modification of the file. To properly set the owner of /boot/grub2/user.cfg, run the command:

$ sudo chown root /boot/grub2/user.cfg

Rationale

Only root should be able to modify important boot parameters. Also, non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.

OVAL test results details

Testing user ownership of /boot/grub2/user.cfg oval:ssg-test_file_owner_user_cfg_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_user_cfg_0:obj:1 of type file_object

Filepath	Filter	Filter
/boot/grub2/user.cfg	oval:ssg-symlink_file_owner_user_cfg_uid_0:ste:1	oval:ssg-state_file_owner_user_cfg_uid_0_0:ste:1

Verify /boot/grub2/grub.cfg Permissions

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_grub2_cfg:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
cui	3.4.5
disa	CCI-000225
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
anssi	R29
cis	1.4.2
pcidss4	2.2.6, 2.2

Description

File permissions for /boot/grub2/grub.cfg should be set to 600. To properly set the permissions of /boot/grub2/grub.cfg, run the command:

$ sudo chmod 600 /boot/grub2/grub.cfg

Rationale

Proper permissions ensure that only the root user can modify important boot parameters.

OVAL test results details

Testing mode of /boot/grub2/grub.cfg oval:ssg-test_file_permissions_grub2_cfg_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_grub2_cfg_0:obj:1 of type file_object

Filepath	Filter	Filter
/boot/grub2/grub.cfg	oval:ssg-exclude_symlinks__grub2_cfg:ste:1	oval:ssg-state_file_permissions_grub2_cfg_0_mode_0600or_stricter_:ste:1

Verify /boot/grub2/user.cfg Permissions

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_user_cfg

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_user_cfg:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
cui	3.4.5
disa	CCI-000225
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
anssi	R29
cis	1.4.2
pcidss4	2.2.6, 2.2

Description

File permissions for /boot/grub2/user.cfg should be set to 600. To properly set the permissions of /boot/grub2/user.cfg, run the command:

$ sudo chmod 600 /boot/grub2/user.cfg

Rationale

Proper permissions ensure that only the root user can read or modify important boot parameters.

OVAL test results details

Testing mode of /boot/grub2/user.cfg oval:ssg-test_file_permissions_user_cfg_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_user_cfg_0:obj:1 of type file_object

Filepath	Filter	Filter
/boot/grub2/user.cfg	oval:ssg-exclude_symlinks__user_cfg:ste:1	oval:ssg-state_file_permissions_user_cfg_0_mode_0600or_stricter_:ste:1

Set Boot Loader Password in grub2

Rule ID xccdf_org.ssgproject.content_rule_grub2_password

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-grub2_password:def:1

Time 2025-06-26T17:28:21+00:00

Severity high

References:

cis-csc	1, 11, 12, 14, 15, 16, 18, 3, 5
cobit5	DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10
cui	3.4.5
disa	CCI-000213
hipaa	164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii)
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7
iso27001-2013	A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nist	CM-6(a)
nist-csf	PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.PT-3
os-srg	SRG-OS-000080-GPOS-00048
anssi	R5
cis	1.4.1

Description

The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings.

Since plaintext passwords are a security risk, generate a hash for the password by running the following command:

# grub2-setpassword

When prompted, enter the password that was selected.

Rationale

Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.

Warnings

warning To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation must be automated as a component of machine provisioning, or followed manually as outlined above. Also, do NOT manually add the superuser account and password to the grub.cfg file as the grub2-mkconfig command overwrites this file.

OVAL test results details

make sure a password is defined in /boot/grub2/user.cfg oval:ssg-test_grub2_password_usercfg:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_grub2_password_usercfg:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/boot/grub2/user.cfg	^[\s]GRUB2_PASSWORD=grub\.pbkdf2\.sha512.$	1

make sure a password is defined in /boot/grub2/grub.cfg oval:ssg-test_grub2_password_grubcfg:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_grub2_password_grubcfg:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/boot/grub2/grub.cfg	^[\s]password_pbkdf2[\s]+.[\s]+grub\.pbkdf2\.sha512.*$	1

superuser is defined in /boot/grub2/grub.cfg files. oval:ssg-test_bootloader_superuser:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/boot/grub2/grub.cfg	set superusers="root"

Ensure Log Files Are Owned By Appropriate Group

Rule ID xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-rsyslog_files_groupownership:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-001314
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
ism	0988, 1405
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-10.5.1, Req-10.5.2
anssi	R71
cis	6.2.4.1
pcidss4	10.3.2, 10.3

Description

The group-owner of all log files written by rsyslog should be root. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's group owner:

$ ls -l LOGFILE

If the owner is not root, run the following command to correct this:

$ sudo chgrp root LOGFILE

Rationale

The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.

OVAL test results details

System log files have appropriate groupowner set oval:ssg-test_rsyslog_files_groupownership:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Type	Size (B)	Permissions
true	/var/log/secure	regular	22712	`rw-r-----`
true	/var/log/messages	regular	229346	`rw-r-----`
true	/var/log/maillog	regular	0	`rw-r-----`
true	/var/log/cron	regular	5464	`rw-r-----`
true	/var/log/spooler	regular	0	`rw-r-----`
true	/var/log/cloud-init.log	regular	145788	`rw-r-----`

Ensure Log Files Are Owned By Appropriate User

Rule ID xccdf_org.ssgproject.content_rule_rsyslog_files_ownership

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-rsyslog_files_ownership:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-001314
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
ism	0988, 1405
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-10.5.1, Req-10.5.2
anssi	R71
cis	6.2.4.1
pcidss4	10.3.2, 10.3

Description

The owner of all log files written by rsyslog should be root. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's owner:

$ ls -l LOGFILE

If the owner is not root, run the following command to correct this:

$ sudo chown root LOGFILE

Rationale

OVAL test results details

System log files have appropriate owner set oval:ssg-test_rsyslog_files_ownership:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Type	Size (B)	Permissions
true	/var/log/secure	regular	22712	`rw-r-----`
true	/var/log/messages	regular	229346	`rw-r-----`
true	/var/log/maillog	regular	0	`rw-r-----`
true	/var/log/cron	regular	5464	`rw-r-----`
true	/var/log/spooler	regular	0	`rw-r-----`
true	/var/log/cloud-init.log	regular	145788	`rw-r-----`

Ensure System Log Files Have Correct Permissions

Rule ID xccdf_org.ssgproject.content_rule_rsyslog_files_permissions

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-rsyslog_files_permissions:def:1

Time 2025-06-26T17:28:21+00:00

Severity medium

References:

disa	CCI-001314
ism	0988, 1405
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
pcidss	Req-10.5.1, Req-10.5.2
anssi	R71
cis	6.2.4.1
pcidss4	10.3.1, 10.3

Description

The file permissions for all log files written by rsyslog should be set to 640, or more restrictive. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's permissions:

$ ls -l LOGFILE

If the permissions are not 640 or more restrictive, run the following command to correct this:

$ sudo chmod 640 LOGFILE

Rationale

Log files can contain valuable information regarding system configuration. If the system log files are not protected unauthorized users could change the logged data, eliminating their forensic value.

OVAL test results details

System log files have appropriate permissions set oval:ssg-test_rsyslog_files_permissions:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Type	Size (B)	Permissions
true	/var/log/secure	regular	22712	`rw-r-----`
true	/var/log/messages	regular	229346	`rw-r-----`
true	/var/log/maillog	regular	0	`rw-r-----`
true	/var/log/cron	regular	5464	`rw-r-----`
true	/var/log/spooler	regular	0	`rw-r-----`
true	/var/log/cloud-init.log	regular	145788	`rw-r-----`

Install systemd-journal-remote Package

Rule ID

xccdf_org.ssgproject.content_rule_package_systemd-journal-remote_installed

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-package_systemd-journal-remote_installed:def:1

Time

2025-06-26T17:28:21+00:00

Severity

medium

References:

os-srg	SRG-OS-000479-GPOS-00224
cis	6.2.2.1.1

Description

Journald (via systemd-journal-remote ) supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralised log management.

Rationale

Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.

OVAL test results details

package systemd-journal-remote is installed oval:ssg-test_package_systemd-journal-remote_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	systemd-journal-remote	x86_64	(none)	51.el9_6.1.alma.1	252	0:252-51.el9_6.1.alma.1	d36cb86cb86b3716	systemd-journal-remote-0:252-51.el9_6.1.alma.1.x86_64

Enable systemd-journald Service

Rule ID xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-service_systemd-journald_enabled:def:1

Time 2025-06-26T17:28:23+00:00

Severity medium

References:

disa	CCI-001665
nist	SC-24
os-srg	SRG-OS-000269-GPOS-00103
cis	6.2.1.1

Description

The systemd-journald service is an essential component of systemd. The systemd-journald service can be enabled with the following command:

$ sudo systemctl enable systemd-journald.service

Rationale

In the event of a system failure, AlmaLinux OS 9 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to system processes.

OVAL test results details

package systemd is installed oval:ssg-test_service_systemd-journald_package_systemd_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	systemd	x86_64	(none)	51.el9_6.1.alma.1	252	0:252-51.el9_6.1.alma.1	d36cb86cb86b3716	systemd-0:252-51.el9_6.1.alma.1.x86_64

Test that the systemd-journald service is running oval:ssg-test_service_running_systemd-journald:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
true	systemd-journald.service	ActiveState	active
true	systemd-journald.socket	ActiveState	active

systemd test oval:ssg-test_multi_user_wants_systemd-journald:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
true	multi-user.target	basic.target	sysinit.target	selinux-autorelabel-mark.service	systemd-sysusers.service	systemd-journal-catalog-update.service	cryptsetup.target	sys-kernel-debug.mount	nis-domainname.service	dev-mqueue.mount	systemd-random-seed.service	systemd-modules-load.service	dracut-shutdown.service	proc-sys-fs-binfmt_misc.automount	sys-kernel-tracing.mount	systemd-sysctl.service	systemd-update-done.service	systemd-pcrphase-sysinit.service	systemd-udevd.service	systemd-tmpfiles-setup.service	systemd-network-generator.service	swap.target	ldconfig.service	systemd-pcrmachine.service	systemd-update-utmp.service	dev-hugepages.mount	systemd-udev-trigger.service	integritysetup.target	sys-kernel-config.mount	systemd-journal-flush.service	kmod-static-nodes.service	systemd-machine-id-commit.service	systemd-journald.service	systemd-repart.service	systemd-binfmt.service	veritysetup.target	systemd-boot-random-seed.service	systemd-boot-update.service	systemd-tmpfiles-setup-dev.service	systemd-ask-password-console.path	systemd-firstboot.service	sys-fs-fuse-connections.mount	local-fs.target	boot-efi.mount	-.mount	boot.mount	systemd-remount-fs.service	systemd-pcrphase.service	systemd-hwdb-update.service	paths.target	microcode.service	slices.target	-.slice	system.slice	sockets.target	rpcbind.socket	dbus.socket	systemd-initctl.socket	systemd-journald-dev-log.socket	systemd-udevd-control.socket	sssd-kcm.socket	systemd-journald.socket	systemd-udevd-kernel.socket	systemd-coredump.socket	timers.target	logrotate.timer	systemd-tmpfiles-clean.timer	dnf-makecache.timer	sssd.service	chronyd.service	nfs-client.target	remote-fs-pre.target	auth-rpcgss-module.service	rpc-statd-notify.service	firewalld.service	NetworkManager.service	cloud-init.target	cloud-init-local.service	cloud-init.service	cloud-config.service	cloud-final.service	tuned.service	getty.target	[email protected]	[email protected]	irqbalance.service	auditd.service	sshd.service	systemd-update-utmp-runlevel.service	systemd-logind.service	rsyslog.service	systemd-user-sessions.service	crond.service	systemd-ask-password-wall.path	droplet-agent.service	remote-fs.target

systemd test oval:ssg-test_multi_user_wants_systemd-journald_socket:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
true	multi-user.target	basic.target	sysinit.target	selinux-autorelabel-mark.service	systemd-sysusers.service	systemd-journal-catalog-update.service	cryptsetup.target	sys-kernel-debug.mount	nis-domainname.service	dev-mqueue.mount	systemd-random-seed.service	systemd-modules-load.service	dracut-shutdown.service	proc-sys-fs-binfmt_misc.automount	sys-kernel-tracing.mount	systemd-sysctl.service	systemd-update-done.service	systemd-pcrphase-sysinit.service	systemd-udevd.service	systemd-tmpfiles-setup.service	systemd-network-generator.service	swap.target	ldconfig.service	systemd-pcrmachine.service	systemd-update-utmp.service	dev-hugepages.mount	systemd-udev-trigger.service	integritysetup.target	sys-kernel-config.mount	systemd-journal-flush.service	kmod-static-nodes.service	systemd-machine-id-commit.service	systemd-journald.service	systemd-repart.service	systemd-binfmt.service	veritysetup.target	systemd-boot-random-seed.service	systemd-boot-update.service	systemd-tmpfiles-setup-dev.service	systemd-ask-password-console.path	systemd-firstboot.service	sys-fs-fuse-connections.mount	local-fs.target	boot-efi.mount	-.mount	boot.mount	systemd-remount-fs.service	systemd-pcrphase.service	systemd-hwdb-update.service	paths.target	microcode.service	slices.target	-.slice	system.slice	sockets.target	rpcbind.socket	dbus.socket	systemd-initctl.socket	systemd-journald-dev-log.socket	systemd-udevd-control.socket	sssd-kcm.socket	systemd-journald.socket	systemd-udevd-kernel.socket	systemd-coredump.socket	timers.target	logrotate.timer	systemd-tmpfiles-clean.timer	dnf-makecache.timer	sssd.service	chronyd.service	nfs-client.target	remote-fs-pre.target	auth-rpcgss-module.service	rpc-statd-notify.service	firewalld.service	NetworkManager.service	cloud-init.target	cloud-init-local.service	cloud-init.service	cloud-config.service	cloud-final.service	tuned.service	getty.target	[email protected]	[email protected]	irqbalance.service	auditd.service	sshd.service	systemd-update-utmp-runlevel.service	systemd-logind.service	rsyslog.service	systemd-user-sessions.service	crond.service	systemd-ask-password-wall.path	droplet-agent.service	remote-fs.target

Ensure journald is configured to compress large log files

Rule ID

xccdf_org.ssgproject.content_rule_journald_compress

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-journald_compress:def:1

Time

2025-06-26T17:28:23+00:00

Severity

medium

References:

cis	6.2.2.3

Description

The journald system can compress large log files to avoid fill the system disk.

Rationale

Log files that are not properly compressed run the risk of growing so large that they fill up the log partition. Valuable logging information could be lost if the log partition becomes full.

OVAL test results details

tests the value of Compress setting in the /etc/systemd/journald.conf file oval:ssg-test_journald_compress:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/systemd/journald.conf	Compress=yes

Ensure journald is configured to write log files to persistent disk

Rule ID

xccdf_org.ssgproject.content_rule_journald_storage

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-journald_storage:def:1

Time

2025-06-26T17:28:23+00:00

Severity

medium

References:

cis	6.2.2.4

Description

The journald system may store log files in volatile memory or locally on disk. If the logs are only stored in volatile memory they will we lost upon reboot.

Rationale

Log files contain valuable data and need to be persistent to aid in possible investigations.

OVAL test results details

tests the value of Storage setting in the /etc/systemd/journald.conf file oval:ssg-test_journald_storage:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/systemd/journald.conf	Storage=persistent

Disable systemd-journal-remote Socket

Rule ID xccdf_org.ssgproject.content_rule_socket_systemd-journal-remote_disabled

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-socket_systemd-journal-remote_disabled:def:1

Time 2025-06-26T17:28:24+00:00

Severity medium

References:

cis	6.2.2.1.4

Description

Journald supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts. NOTE: The same package, systemd-journal-remote , is used for both sending logs to remote hosts and receiving incoming logs. With regards to receiving logs, there are two Systemd unit files; systemd-journal-remote.socket and systemd-journal-remote.service.

Rationale

If a client is configured to also receive data, thus turning it into a server, the client system is acting outside it's operational boundary.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	disable

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

SOCKET_NAME="systemd-journal-remote.socket"
SYSTEMCTL_EXEC='/usr/bin/systemctl'

if "$SYSTEMCTL_EXEC" -q list-unit-files --type socket | grep -q "$SOCKET_NAME"; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop "$SOCKET_NAME"
    fi
    "$SYSTEMCTL_EXEC" mask "$SOCKET_NAME"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	disable

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - socket_systemd-journal-remote_disabled

- name: Disable systemd-journal-remote Socket - Collect systemd Socket Units Present
    in the System
  ansible.builtin.command:
    cmd: systemctl -q list-unit-files --type socket
  register: result_systemd_unit_files
  changed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - socket_systemd-journal-remote_disabled

- name: Disable systemd-journal-remote Socket - Ensure systemd-journal-remote.socket
    is Masked
  ansible.builtin.systemd:
    name: systemd-journal-remote.socket
    state: stopped
    enabled: false
    masked: true
  when:
  - '"kernel" in ansible_facts.packages'
  - result_systemd_unit_files.stdout_lines is search("systemd-journal-remote.socket")
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - socket_systemd-journal-remote_disabled

OVAL test results details

Test that the property LoadState from the systemd-journal-remote.socket is masked oval:ssg-test_socket_loadstate_is_masked_systemd-journal-remote:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
false	systemd-journal-remote.socket	LoadState	loaded

Install firewalld Package

Rule ID xccdf_org.ssgproject.content_rule_package_firewalld_installed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_firewalld_installed:def:1

Time 2025-06-26T17:28:24+00:00

Severity medium

References:

disa	CCI-000382, CCI-000366, CCI-002314, CCI-002322
nist	CM-6(a)
ospp	FMT_SMF_EXT.1
os-srg	SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232
cis	4.1.2
pcidss4	1.2.1, 1.2

Description

The firewalld package can be installed with the following command:

$ sudo dnf install firewalld

Rationale

"Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. AlmaLinux OS 9 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."

OVAL test results details

package firewalld is installed oval:ssg-test_package_firewalld_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	firewalld	noarch	(none)	9.el9_5	1.3.4	0:1.3.4-9.el9_5	d36cb86cb86b3716	firewalld-0:1.3.4-9.el9_5.noarch

Verify firewalld Enabled

Rule ID xccdf_org.ssgproject.content_rule_service_firewalld_enabled

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-service_firewalld_enabled:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	11, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05
cui	3.1.3, 3.4.7
disa	CCI-000382, CCI-000366, CCI-002314
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4
nerc-cip	CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3
nist	AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a)
nist-csf	PR.IP-1
ospp	FMT_SMF_EXT.1
os-srg	SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232
bsi	SYS.1.6.A5, SYS.1.6.A21
cis	4.1.2
pcidss4	1.2.1, 1.2

Description

The firewalld service can be enabled with the following command:

$ sudo systemctl enable firewalld.service

Rationale

Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	enable

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel && { rpm --quiet -q firewalld; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'firewalld.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'firewalld.service'
fi
"$SYSTEMCTL_EXEC" enable 'firewalld.service'

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	enable

include enable_firewalld

class enable_firewalld {
  service {'firewalld':
    enable => true,
    ensure => 'running',
  }
}

Remediation script ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	disable


service enable firewalld

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	enable

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.3
  - NIST-800-171-3.4.7
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_firewalld_enabled

- name: Verify firewalld Enabled - Enable service firewalld
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Verify firewalld Enabled - Enable Service firewalld
    ansible.builtin.systemd:
      name: firewalld
      enabled: true
      state: started
      masked: false
    when:
    - '"firewalld" in ansible_facts.packages'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"firewalld" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.3
  - NIST-800-171-3.4.7
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_firewalld_enabled

Remediation OSBuild Blueprint snippet ⇲


[customizations.services]
enabled = ["firewalld"]

OVAL test results details

package firewalld is installed oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	firewalld	noarch	(none)	9.el9_5	1.3.4	0:1.3.4-9.el9_5	d36cb86cb86b3716	firewalld-0:1.3.4-9.el9_5.noarch

Test that the firewalld service is running oval:ssg-test_service_running_firewalld:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
false	firewalld.service	ActiveState	inactive

systemd test oval:ssg-test_multi_user_wants_firewalld:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
true	multi-user.target	basic.target	sysinit.target	selinux-autorelabel-mark.service	systemd-sysusers.service	systemd-journal-catalog-update.service	cryptsetup.target	sys-kernel-debug.mount	nis-domainname.service	dev-mqueue.mount	systemd-random-seed.service	systemd-modules-load.service	dracut-shutdown.service	proc-sys-fs-binfmt_misc.automount	sys-kernel-tracing.mount	systemd-sysctl.service	systemd-update-done.service	systemd-pcrphase-sysinit.service	systemd-udevd.service	systemd-tmpfiles-setup.service	systemd-network-generator.service	swap.target	ldconfig.service	systemd-pcrmachine.service	systemd-update-utmp.service	dev-hugepages.mount	systemd-udev-trigger.service	integritysetup.target	sys-kernel-config.mount	systemd-journal-flush.service	kmod-static-nodes.service	systemd-machine-id-commit.service	systemd-journald.service	systemd-repart.service	systemd-binfmt.service	veritysetup.target	systemd-boot-random-seed.service	systemd-boot-update.service	systemd-tmpfiles-setup-dev.service	systemd-ask-password-console.path	systemd-firstboot.service	sys-fs-fuse-connections.mount	local-fs.target	boot-efi.mount	-.mount	boot.mount	systemd-remount-fs.service	systemd-pcrphase.service	systemd-hwdb-update.service	paths.target	microcode.service	slices.target	-.slice	system.slice	sockets.target	rpcbind.socket	dbus.socket	systemd-initctl.socket	systemd-journald-dev-log.socket	systemd-udevd-control.socket	sssd-kcm.socket	systemd-journald.socket	systemd-udevd-kernel.socket	systemd-coredump.socket	timers.target	logrotate.timer	systemd-tmpfiles-clean.timer	dnf-makecache.timer	sssd.service	chronyd.service	nfs-client.target	remote-fs-pre.target	auth-rpcgss-module.service	rpc-statd-notify.service	firewalld.service	NetworkManager.service	cloud-init.target	cloud-init-local.service	cloud-init.service	cloud-config.service	cloud-final.service	tuned.service	getty.target	[email protected]	[email protected]	irqbalance.service	auditd.service	sshd.service	systemd-update-utmp-runlevel.service	systemd-logind.service	rsyslog.service	systemd-user-sessions.service	crond.service	systemd-ask-password-wall.path	droplet-agent.service	remote-fs.target

systemd test oval:ssg-test_multi_user_wants_firewalld_socket:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
false	multi-user.target	basic.target	sysinit.target	selinux-autorelabel-mark.service	systemd-sysusers.service	systemd-journal-catalog-update.service	cryptsetup.target	sys-kernel-debug.mount	nis-domainname.service	dev-mqueue.mount	systemd-random-seed.service	systemd-modules-load.service	dracut-shutdown.service	proc-sys-fs-binfmt_misc.automount	sys-kernel-tracing.mount	systemd-sysctl.service	systemd-update-done.service	systemd-pcrphase-sysinit.service	systemd-udevd.service	systemd-tmpfiles-setup.service	systemd-network-generator.service	swap.target	ldconfig.service	systemd-pcrmachine.service	systemd-update-utmp.service	dev-hugepages.mount	systemd-udev-trigger.service	integritysetup.target	sys-kernel-config.mount	systemd-journal-flush.service	kmod-static-nodes.service	systemd-machine-id-commit.service	systemd-journald.service	systemd-repart.service	systemd-binfmt.service	veritysetup.target	systemd-boot-random-seed.service	systemd-boot-update.service	systemd-tmpfiles-setup-dev.service	systemd-ask-password-console.path	systemd-firstboot.service	sys-fs-fuse-connections.mount	local-fs.target	boot-efi.mount	-.mount	boot.mount	systemd-remount-fs.service	systemd-pcrphase.service	systemd-hwdb-update.service	paths.target	microcode.service	slices.target	-.slice	system.slice	sockets.target	rpcbind.socket	dbus.socket	systemd-initctl.socket	systemd-journald-dev-log.socket	systemd-udevd-control.socket	sssd-kcm.socket	systemd-journald.socket	systemd-udevd-kernel.socket	systemd-coredump.socket	timers.target	logrotate.timer	systemd-tmpfiles-clean.timer	dnf-makecache.timer	sssd.service	chronyd.service	nfs-client.target	remote-fs-pre.target	auth-rpcgss-module.service	rpc-statd-notify.service	firewalld.service	NetworkManager.service	cloud-init.target	cloud-init-local.service	cloud-init.service	cloud-config.service	cloud-final.service	tuned.service	getty.target	[email protected]	[email protected]	irqbalance.service	auditd.service	sshd.service	systemd-update-utmp-runlevel.service	systemd-logind.service	rsyslog.service	systemd-user-sessions.service	crond.service	systemd-ask-password-wall.path	droplet-agent.service	remote-fs.target

Configure Firewalld to Restrict Loopback Traffic

Rule ID xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-firewalld_loopback_traffic_restricted:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis	4.2.2
pcidss4	1.4.1, 1.4

Description

Configure firewalld to restrict loopback traffic to the lo interface. The loopback traffic must be trusted by assigning the lo interface to the firewalld trusted zone. However, the loopback traffic must be restricted to the loopback interface as an anti-spoofing measure. To configure firewalld to restrict loopback traffic to the lo interface, run the following commands:

sudo firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
sudo firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6 source address="::1" destination not address="::1" drop'

To ensure firewalld settings are applied in runtime, run the following command:

firewall-cmd --reload

Rationale

Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	configure

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "firewalld" ; then
    dnf install -y "firewalld"
fi

ipv4_rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
ipv6_rule='rule family=ipv6 source address="::1" destination not address="::1" drop'

if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]]; then
    firewall-offline-cmd --zone=trusted --add-rich-rule="${ipv4_rule}"
    firewall-offline-cmd --zone=trusted --add-rich-rule="${ipv6_rule}"
elif systemctl is-active firewalld; then
    firewall-cmd --permanent --zone=trusted --add-rich-rule="${ipv4_rule}"
    firewall-cmd --permanent --zone=trusted --add-rich-rule="${ipv6_rule}"
    firewall-cmd --reload
else
    echo "
    firewalld service is not active. Remediation aborted!
    This remediation could not be applied because it depends on firewalld service running.
    The service is not started by this remediation in order to prevent connection issues."
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	configure

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Package
    is Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Collect Facts About System
    Services
  ansible.builtin.service_facts: null
  register: result_services_states
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Remediation is Applicable
    if firewalld Service is Running
  block:

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted
      Zone Restricts IPv4 Loopback Traffic
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4
        source address="127.0.0.1" destination not address="127.0.0.1" drop'
    register: result_trusted_ipv4_restriction
    changed_when:
    - '''ALREADY_ENABLED'' not in result_trusted_ipv4_restriction.stderr'

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted
      Zone Restricts IPv6 Loopback Traffic
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6
        source address="::1" destination not address="::1" drop'
    register: result_trusted_ipv6_restriction
    changed_when:
    - '''ALREADY_ENABLED'' not in result_trusted_ipv6_restriction.stderr'

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Changes
      are Applied
    ansible.builtin.service:
      name: firewalld
      state: reloaded
    when:
    - result_trusted_ipv4_restriction is changed or result_trusted_ipv6_restriction
      is changed
  when:
  - '"kernel" in ansible_facts.packages'
  - ansible_facts.services['firewalld.service'].state == 'running'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Informative Message Based
    on Service State
  ansible.builtin.assert:
    that:
    - ansible_facts.services['firewalld.service'].state == 'running'
    fail_msg:
    - firewalld service is not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld service
      running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Configure Firewalld to Restrict Loopback Traffic remediation successfully executed
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

OVAL test results details

there is no equivalent file for trusted zone defined by the administrator oval:ssg-test_firewalld_trusted_zone_not_overridden:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_customized_trusted_zone_file:obj:1 of type file_object

Filepath
/etc/firewalld/zones/trusted.xml

default trusted zone has rich-rule to restrict loopback source oval:ssg-test_firewalld_loopback_restricted_source_usr:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_loopback_restricted_source_usr:obj:1 of type xmlfilecontent_object

Filepath	Xpath
/usr/lib/firewalld/zones/trusted.xml	/zone/rule/source[@address='127.0.0.1' or @address='::1']

default trusted zone has rich-rule to restrict loopback destination oval:ssg-test_firewalld_loopback_restricted_destination_usr:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_loopback_restricted_destination_usr:obj:1 of type xmlfilecontent_object

Filepath	Xpath
/usr/lib/firewalld/zones/trusted.xml	/zone/rule/destination[@address='127.0.0.1' or @address='::1' and @invert='True']

default trusted zone has rich-rule to restrict loopback traffic oval:ssg-test_firewalld_loopback_restricted_policy_usr:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_loopback_restricted_policy_usr:obj:1 of type xmlfilecontent_object

Filepath	Xpath
/usr/lib/firewalld/zones/trusted.xml	/zone/rule/drop

custom trusted zone has rich-rule to restrict loopback source oval:ssg-test_firewalld_loopback_restricted_source_etc:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_loopback_restricted_source_etc:obj:1 of type xmlfilecontent_object

Filepath	Xpath
/etc/firewalld/zones/trusted.xml	/zone/rule/source[@address='127.0.0.1' or @address='::1']

custom trusted zone has rich-rule to restrict loopback destination oval:ssg-test_firewalld_loopback_restricted_destination_etc:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_loopback_restricted_destination_etc:obj:1 of type xmlfilecontent_object

Filepath	Xpath
/etc/firewalld/zones/trusted.xml	/zone/rule/destination[@address='127.0.0.1' or @address='::1' and @invert='True']

custom trusted zone has rich-rule to restrict loopback traffic oval:ssg-test_firewalld_loopback_restricted_policy_etc:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_loopback_restricted_policy_etc:obj:1 of type xmlfilecontent_object

Filepath	Xpath
/etc/firewalld/zones/trusted.xml	/zone/rule/drop

Configure Firewalld to Trust Loopback Traffic

Rule ID xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-firewalld_loopback_traffic_trusted:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis	4.2.2
pcidss4	1.4.1, 1.4

Description

Assign loopback interface to the firewalld trusted zone in order to explicitly allow the loopback traffic in the system. To configure firewalld to trust loopback traffic, run the following command:

sudo firewall-cmd --permanent --zone=trusted --add-interface=lo

To ensure firewalld settings are applied in runtime, run the following command:

firewall-cmd --reload

Rationale

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	configure

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "firewalld" ; then
    dnf install -y "firewalld"
fi

if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]]; then
    firewall-offline-cmd --zone=trusted --add-interface=lo
elif systemctl is-active firewalld; then
    firewall-cmd --permanent --zone=trusted --add-interface=lo
    firewall-cmd --reload
else
    echo "
    firewalld service is not active. Remediation aborted!
    This remediation could not be applied because it depends on firewalld service running.
    The service is not started by this remediation in order to prevent connection issues."
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	configure

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Package is
    Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Collect Facts About System
    Services
  ansible.builtin.service_facts: null
  register: result_services_states
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Remediation is Applicable
    if firewalld Service is Running
  block:

  - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld trusted
      Zone Includes lo Interface
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-interface=lo
    register: result_lo_interface_assignment
    changed_when:
    - '''ALREADY_ENABLED'' not in result_lo_interface_assignment.stderr'

  - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Changes
      are Applied
    ansible.builtin.service:
      name: firewalld
      state: reloaded
    when:
    - result_lo_interface_assignment is changed
  when:
  - '"kernel" in ansible_facts.packages'
  - ansible_facts.services['firewalld.service'].state == 'running'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Informative Message Based
    on Service State
  ansible.builtin.assert:
    that:
    - ansible_facts.services['firewalld.service'].state == 'running'
    fail_msg:
    - firewalld service is not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld service
      running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Configure Firewalld to Trust Loopback Traffic remediation successfully executed
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

OVAL test results details

lo interface is assigned to the trusted zone by default oval:ssg-test_firewalld_lo_interface_trusted_usr:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_lo_interface_trusted_usr:obj:1 of type xmlfilecontent_object

Filepath	Xpath
/usr/lib/firewalld/zones/trusted.xml	/zone/interface[@name='lo']

there is no equivalent file for trusted zone defined by the administrator oval:ssg-test_firewalld_trusted_zone_not_overridden:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_customized_trusted_zone_file:obj:1 of type file_object

Filepath
/etc/firewalld/zones/trusted.xml

lo interface is assigned to the custom trusted zone in /etc/firewalld/zones oval:ssg-test_firewalld_lo_interface_trusted_etc:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_firewalld_lo_interface_trusted_etc:obj:1 of type xmlfilecontent_object

Filepath	Xpath
/etc/firewalld/zones/trusted.xml	/zone/interface[@name='lo']

Configure Accepting Router Advertisements on All IPv6 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
cis	3.3.11

Description

To set the runtime status of the net.ipv6.conf.all.accept_ra kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.accept_ra=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.all.accept_ra = 0

Rationale

An illicit router advertisement message could result in a man-in-the-middle attack.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Value
false	net.ipv6.conf.all.disable_ipv6	0

net.ipv6.conf.all.accept_ra static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv6.conf.all.accept_ra = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_ra = 0

net.ipv6.conf.all.accept_ra static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv6.conf.all.accept_ra = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_ra = 0

net.ipv6.conf.all.accept_ra static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.accept_ra[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv6.conf.all.accept_ra	0

Disable Accepting ICMP Redirects for All IPv6 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv)
nist-csf	PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R13
cis	3.3.5

Description

To set the runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.all.accept_redirects = 0

Rationale

An illicit ICMP redirect message could result in a man-in-the-middle attack.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Value
false	net.ipv6.conf.all.disable_ipv6	0

net.ipv6.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_redirects = 0
true	/etc/sysctl.conf	net.ipv6.conf.all.accept_redirects = 0

net.ipv6.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_redirects = 0
not evaluated	/etc/sysctl.conf	net.ipv6.conf.all.accept_redirects = 0

net.ipv6.conf.all.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.accept_redirects[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv6.conf.all.accept_redirects	0

Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9
cobit5	APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.4.3.3
isa-62443-2013	SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R13
cis	3.3.8

Description

To set the runtime status of the net.ipv6.conf.all.accept_source_route kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.all.accept_source_route = 0

Rationale

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.

Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Value
false	net.ipv6.conf.all.disable_ipv6	0

net.ipv6.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv6.conf.all.accept_source_route = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_source_route = 0

net.ipv6.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv6.conf.all.accept_source_route = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_source_route = 0

net.ipv6.conf.all.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.accept_source_route[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv6.conf.all.accept_source_route	0

Disable Kernel Parameter for IPv6 Forwarding

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9
cobit5	APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv)
nist-csf	DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
cis	3.3.1

Description

To set the runtime status of the net.ipv6.conf.all.forwarding kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.forwarding=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.all.forwarding = 0

Rationale

IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Value
false	net.ipv6.conf.all.disable_ipv6	0

net.ipv6.conf.all.forwarding static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv6.conf.all.forwarding = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.forwarding = 0

net.ipv6.conf.all.forwarding static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv6.conf.all.forwarding = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.forwarding = 0

net.ipv6.conf.all.forwarding static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.forwarding[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv6.conf.all.forwarding	0

Disable Accepting Router Advertisements on all IPv6 Interfaces by Default

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
cis	3.3.11

Description

To set the runtime status of the net.ipv6.conf.default.accept_ra kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.default.accept_ra = 0

Rationale

An illicit router advertisement message could result in a man-in-the-middle attack.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Value
false	net.ipv6.conf.all.disable_ipv6	0

net.ipv6.conf.default.accept_ra static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv6.conf.default.accept_ra = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_ra = 0

net.ipv6.conf.default.accept_ra static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv6.conf.default.accept_ra = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_ra = 0

net.ipv6.conf.default.accept_ra static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.default.accept_ra[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv6.conf.default.accept_ra	0

Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R13
cis	3.3.5

Description

To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.default.accept_redirects = 0

Rationale

An illicit ICMP redirect message could result in a man-in-the-middle attack.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Value
false	net.ipv6.conf.all.disable_ipv6	0

net.ipv6.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_redirects = 0
true	/etc/sysctl.conf	net.ipv6.conf.default.accept_redirects = 0

net.ipv6.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_redirects = 0
not evaluated	/etc/sysctl.conf	net.ipv6.conf.default.accept_redirects = 0

net.ipv6.conf.default.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.default.accept_redirects[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv6.conf.default.accept_redirects	0

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9
cobit5	APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.4.3.3
isa-62443-2013	SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv)
nist-csf	DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4
pcidss	Req-1.4.3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R13
cis	3.3.8
pcidss4	1.4.2, 1.4

Description

To set the runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.default.accept_source_route = 0

Rationale

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Value
false	net.ipv6.conf.all.disable_ipv6	0

net.ipv6.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv6.conf.default.accept_source_route = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_source_route = 0

net.ipv6.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv6.conf.default.accept_source_route = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_source_route = 0

net.ipv6.conf.default.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.default.accept_source_route[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv6.conf.default.accept_source_route	0

Disable Accepting ICMP Redirects for All IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9
cjis	5.10.1.1
cobit5	APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a), SC-7(a)
nist-csf	DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.5

Description

To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.all.accept_redirects = 0

Rationale

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required."

OVAL test results details

net.ipv4.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_redirects = 0
true	/etc/sysctl.conf	net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_redirects = 0
not evaluated	/etc/sysctl.conf	net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.all.accept_redirects[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.all.accept_redirects	0

Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
cobit5	APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1
nist	CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.8

Description

To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.all.accept_source_route = 0

Rationale

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.

Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

OVAL test results details

net.ipv4.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.all.accept_source_route = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_source_route = 0

net.ipv4.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.conf.all.accept_source_route = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_source_route = 0

net.ipv4.conf.all.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.all.accept_source_route[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.all.accept_source_route	0

Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1

Time 2025-06-26T17:28:26+00:00

Severity unknown

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9
cobit5	APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2
nist	CM-7(a), CM-7(b), SC-5(3)(a)
nist-csf	DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
cis	3.3.9

Description

To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.log_martians=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.all.log_martians = 1

Rationale

The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.

OVAL test results details

net.ipv4.conf.all.log_martians static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.log_martians = 1
true	/etc/sysctl.conf	net.ipv4.conf.all.log_martians = 1

net.ipv4.conf.all.log_martians static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.log_martians = 1
not evaluated	/etc/sysctl.conf	net.ipv4.conf.all.log_martians = 1

net.ipv4.conf.all.log_martians static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.all.log_martians[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.all.log_martians	1

Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9
cobit5	APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.4.3.3
isa-62443-2013	SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-7(a), CM-7(b), CM-6(a), SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4
pcidss	Req-1.4.3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.7
pcidss4	1.4.3, 1.4

Description

To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.all.rp_filter = 1

Rationale

Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.

OVAL test results details

net.ipv4.conf.all.rp_filter static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.all.rp_filter = 1
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.all.rp_filter static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.conf.all.rp_filter = 1
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.all.rp_filter static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.all.rp_filter[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.all.rp_filter	1

Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
cobit5	APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06
cui	3.1.20
disa	CCI-001503, CCI-001551
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-7(a), CM-7(b), CM-6(a), SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4
pcidss	Req-1.4.3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.6
pcidss4	1.4.3, 1.4

Description

To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.all.secure_redirects = 0

Rationale

Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

OVAL test results details

net.ipv4.conf.all.secure_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.all.secure_redirects = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.secure_redirects = 0

net.ipv4.conf.all.secure_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.conf.all.secure_redirects = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.secure_redirects = 0

net.ipv4.conf.all.secure_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.all.secure_redirects[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.all.secure_redirects	0

Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
cjis	5.10.1.1
cobit5	APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-7(a), CM-7(b), CM-6(a), SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4
pcidss	Req-1.4.3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.5
pcidss4	1.4.3, 1.4

Description

To set the runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.default.accept_redirects = 0

Rationale

OVAL test results details

net.ipv4.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.default.accept_redirects = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.conf.default.accept_redirects = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.default.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.default.accept_redirects[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.default.accept_redirects	0

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1

Time 2025-06-26T17:28:26+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
cjis	5.10.1.1
cobit5	APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1
nist	CM-7(a), CM-7(b), SC-5, SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.8

Description

To set the runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.default.accept_source_route = 0

Rationale

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.

OVAL test results details

net.ipv4.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/lib/sysctl.d/50-default.conf	net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/lib/sysctl.d/50-default.conf	net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.default.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_pkg_correct:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/usr/lib/sysctl.d/50-default.conf	net.ipv4.conf.default.accept_source_route = 0

kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.default.accept_source_route	0

Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1

Time 2025-06-26T17:28:26+00:00

Severity unknown

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9
cobit5	APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2
nist	CM-7(a), CM-7(b), SC-5(3)(a)
nist-csf	DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
cis	3.3.9

Description

To set the runtime status of the net.ipv4.conf.default.log_martians kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.default.log_martians=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.default.log_martians = 1

Rationale

OVAL test results details

net.ipv4.conf.default.log_martians static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.default.log_martians = 1
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.log_martians = 1

net.ipv4.conf.default.log_martians static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.conf.default.log_martians = 1
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.log_martians = 1

net.ipv4.conf.default.log_martians static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.default.log_martians[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.default.log_martians	1

Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1

Time 2025-06-26T17:28:27+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9
cobit5	APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.4.3.3
isa-62443-2013	SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-7(a), CM-7(b), CM-6(a), SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.7

Description

To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.default.rp_filter = 1

Rationale

OVAL test results details

net.ipv4.conf.default.rp_filter static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.rp_filter = 1
true	/etc/sysctl.conf	net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.default.rp_filter static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.rp_filter = 1
not evaluated	/etc/sysctl.conf	net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.default.rp_filter static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.default.rp_filter[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.default.rp_filter	1

Configure Kernel Parameter for Accepting Secure Redirects By Default

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1

Time 2025-06-26T17:28:27+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
cobit5	APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06
cui	3.1.20
disa	CCI-001551
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1
nist	CM-7(a), CM-7(b), SC-5, SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.6

Description

To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.default.secure_redirects = 0

Rationale

Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

OVAL test results details

net.ipv4.conf.default.secure_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.default.secure_redirects = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.secure_redirects = 0

net.ipv4.conf.default.secure_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.conf.default.secure_redirects = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.secure_redirects = 0

net.ipv4.conf.default.secure_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.default.secure_redirects[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.default.secure_redirects	0

Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1

Time 2025-06-26T17:28:27+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
cjis	5.10.1.1
cobit5	APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1
nist	CM-7(a), CM-7(b), SC-5
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4
pcidss	Req-1.4.3
os-srg	SRG-OS-000480-GPOS-00227
cis	3.3.4
pcidss4	1.4.2, 1.4

Description

To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.icmp_echo_ignore_broadcasts = 1

Rationale

Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.
Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.

OVAL test results details

net.ipv4.icmp_echo_ignore_broadcasts static configuration oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.icmp_echo_ignore_broadcasts = 1
true	/etc/sysctl.conf	net.ipv4.icmp_echo_ignore_broadcasts = 1

net.ipv4.icmp_echo_ignore_broadcasts static configuration oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.icmp_echo_ignore_broadcasts = 1
not evaluated	/etc/sysctl.conf	net.ipv4.icmp_echo_ignore_broadcasts = 1

net.ipv4.icmp_echo_ignore_broadcasts static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.icmp_echo_ignore_broadcasts[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.icmp_echo_ignore_broadcasts	1

Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1

Time 2025-06-26T17:28:27+00:00

Severity unknown

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9
cobit5	APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2
nerc-cip	CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1
nist	CM-7(a), CM-7(b), SC-5
nist-csf	DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3
pcidss	Req-1.4.3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.3
pcidss4	1.4.2, 1.4

Description

To set the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.icmp_ignore_bogus_error_responses = 1

Rationale

Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.

OVAL test results details

net.ipv4.icmp_ignore_bogus_error_responses static configuration oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.icmp_ignore_bogus_error_responses = 1
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.icmp_ignore_bogus_error_responses = 1

net.ipv4.icmp_ignore_bogus_error_responses static configuration oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.icmp_ignore_bogus_error_responses = 1
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.icmp_ignore_bogus_error_responses = 1

net.ipv4.icmp_ignore_bogus_error_responses static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.icmp_ignore_bogus_error_responses[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.icmp_ignore_bogus_error_responses	1

Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1

Time 2025-06-26T17:28:27+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9
cjis	5.10.1.1
cobit5	APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02
cui	3.1.20
disa	CCI-001095, CCI-000366, CCI-002385
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.4.3.3
isa-62443-2013	SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-7(a), CM-7(b), SC-5(1), SC-5(2), SC-5(3)(a), CM-6(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4
pcidss	Req-1.4.1
os-srg	SRG-OS-000480-GPOS-00227, SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00071
anssi	R12
cis	3.3.10
pcidss4	1.4.3, 1.4

Description

To set the runtime status of the net.ipv4.tcp_syncookies kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.tcp_syncookies=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.tcp_syncookies = 1

Rationale

A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests.

OVAL test results details

net.ipv4.tcp_syncookies static configuration oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.tcp_syncookies = 1
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_syncookies static configuration oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.tcp_syncookies = 1
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_syncookies static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.tcp_syncookies[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.tcp_syncookies	1

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1

Time 2025-06-26T17:28:27+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
cjis	5.10.1.1
cobit5	APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1
nist	CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.2
pcidss4	1.4.5, 1.4

Description

To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.all.send_redirects = 0

Rationale

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers.

OVAL test results details

net.ipv4.conf.all.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.all.send_redirects = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.all.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.conf.all.send_redirects = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.all.send_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.all.send_redirects[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0 oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.all.send_redirects	0

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1

Time 2025-06-26T17:28:27+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9
cjis	5.10.1.1
cobit5	APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1
nist	CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a)
nist-csf	DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.2
pcidss4	1.4.5, 1.4

Description

To set the runtime status of the net.ipv4.conf.default.send_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.default.send_redirects = 0

Rationale

OVAL test results details

net.ipv4.conf.default.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.send_redirects = 0
true	/etc/sysctl.conf	net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.default.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.send_redirects = 0
not evaluated	/etc/sysctl.conf	net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.default.send_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.conf.default.send_redirects[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0 oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.conf.default.send_redirects	0

Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces

Rule ID xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_net_ipv4_ip_forward:def:1

Time 2025-06-26T17:28:27+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9
cobit5	APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06
cui	3.1.20
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6
iso27001-2013	A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2
nerc-cip	CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1
nist	CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a)
nist-csf	DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4
pcidss	Req-1.3.1, Req-1.3.2
os-srg	SRG-OS-000480-GPOS-00227
anssi	R12
cis	3.3.1
pcidss4	1.4.3, 1.4

Description

To set the runtime status of the net.ipv4.ip_forward kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.ip_forward=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.ip_forward = 0

Rationale

Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network.

Warnings

warning Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking. Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in profiles or benchmarks that target usage of IPv4 forwarding.

OVAL test results details

net.ipv4.ip_forward static configuration oval:ssg-test_sysctl_net_ipv4_ip_forward_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.ip_forward = 0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.ip_forward = 0

net.ipv4.ip_forward static configuration oval:ssg-test_sysctl_net_ipv4_ip_forward_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	net.ipv4.ip_forward = 0
not evaluated	/etc/sysctl.d/99-sysctl.conf	net.ipv4.ip_forward = 0

net.ipv4.ip_forward static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_ip_forward_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_ip_forward:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv4.ip_forward[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv4.ip_forward set to 0 oval:ssg-test_sysctl_net_ipv4_ip_forward_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	net.ipv4.ip_forward	0

Install nftables Package

Rule ID xccdf_org.ssgproject.content_rule_package_nftables_installed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_nftables_installed:def:1

Time 2025-06-26T17:28:30+00:00

Severity medium

References:

cis	4.1.1
pcidss4	1.2.1, 1.2

Description

nftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem. The nftables package can be installed with the following command:

$ sudo dnf install nftables

Rationale

nftables is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.

OVAL test results details

package nftables is installed oval:ssg-test_package_nftables_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	nftables	x86_64	1	3.el9	1.0.9	1:1.0.9-3.el9	d36cb86cb86b3716	nftables-1:1.0.9-3.el9.x86_64

Verify nftables Service is Disabled

Rule ID xccdf_org.ssgproject.content_rule_service_nftables_disabled

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-service_nftables_disabled:def:1

Time 2025-06-26T17:28:31+00:00

Severity medium

References:

cis	4.1.2
pcidss4	1.2.1, 1.2

Description

nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables. The nftables service can be disabled with the following command:

systemctl disable nftables

Rationale

Running both firewalld and nftables may lead to conflict. nftables is actually one of the backends for firewalld management tools.

Remediation Kubernetes snippet ⇲

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: nftables.service
        enabled: false
        mask: true
      - name: nftables.socket
        enabled: false
        mask: true

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	disable

# Remediation is applicable only in certain platforms
if ( rpm --quiet -q firewalld && rpm --quiet -q nftables && rpm --quiet -q kernel ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'nftables.service'
fi
"$SYSTEMCTL_EXEC" disable 'nftables.service'
"$SYSTEMCTL_EXEC" mask 'nftables.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files nftables.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'nftables.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'nftables.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'nftables.service' || true

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Puppet snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	enable

include disable_nftables

class disable_nftables {
  service {'nftables':
    enable => false,
    ensure => 'stopped',
  }
}

Remediation script ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	disable


service disable nftables

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	disable

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Verify nftables Service is Disabled - Collect systemd Services Present in
    the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and "kernel" in ansible_facts.packages )
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Verify nftables Service is Disabled - Ensure nftables.service is Masked
  ansible.builtin.systemd:
    name: nftables.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and "kernel" in ansible_facts.packages )
  - service_exists.stdout_lines is search("nftables.service", multiline=True)
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Unit Socket Exists - nftables.socket
  ansible.builtin.command: systemctl -q list-unit-files nftables.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and "kernel" in ansible_facts.packages )
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Verify nftables Service is Disabled - Disable Socket nftables
  ansible.builtin.systemd:
    name: nftables.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and "kernel" in ansible_facts.packages )
  - socket_file_exists.stdout_lines is search("nftables.socket", multiline=True)
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

Remediation OSBuild Blueprint snippet ⇲


[customizations.services]
masked = ["nftables"]

OVAL test results details

package nftables is removed oval:ssg-service_nftables_disabled_test_service_nftables_package_nftables_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	nftables	x86_64	1	3.el9	1.0.9	1:1.0.9-3.el9	d36cb86cb86b3716	nftables-1:1.0.9-3.el9.x86_64

Test that the nftables service is not running oval:ssg-test_service_not_running_service_nftables_disabled_nftables:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
true	nftables.service	ActiveState	inactive

Test that the property LoadState from the service nftables is masked oval:ssg-test_service_loadstate_is_masked_service_nftables_disabled_nftables:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
false	nftables.service	LoadState	loaded

Disable Bluetooth Service

Rule ID xccdf_org.ssgproject.content_rule_service_bluetooth_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-service_bluetooth_disabled:def:1

Time 2025-06-26T17:28:33+00:00

Severity medium

References:

cis-csc	11, 12, 14, 15, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06
cui	3.1.16
disa	CCI-000085, CCI-001551
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2
nist	AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7
nist-csf	PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4
cis	3.1.3

Description

The bluetooth service can be disabled with the following command:

$ sudo systemctl mask --now bluetooth.service

$ sudo service bluetooth stop

Rationale

Disabling the bluetooth service prevents the system from attempting connections to Bluetooth devices, which entails some security risk. Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range.

OVAL test results details

package bluez is removed oval:ssg-service_bluetooth_disabled_test_service_bluetooth_package_bluez_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_bluetooth_disabled_test_service_bluetooth_package_bluez_removed:obj:1 of type rpminfo_object

Name
bluez

Test that the bluetooth service is not running oval:ssg-test_service_not_running_service_bluetooth_disabled_bluetooth:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_not_running_service_bluetooth_disabled_bluetooth:obj:1 of type systemdunitproperty_object

Unit	Property
^bluetooth\.(service\|socket)$	ActiveState

Test that the property LoadState from the service bluetooth is masked oval:ssg-test_service_loadstate_is_masked_service_bluetooth_disabled_bluetooth:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_loadstate_is_masked_service_bluetooth_disabled_bluetooth:obj:1 of type systemdunitproperty_object

Unit	Property
^bluetooth\.(service\|socket)$	LoadState

Deactivate Wireless Network Interfaces

Rule ID

xccdf_org.ssgproject.content_rule_wireless_disable_interfaces

Result

notapplicable

Multi-check rule

Time

2025-06-26T17:28:33+00:00

Severity

medium

References:

cis-csc	11, 12, 14, 15, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06
cui	3.1.16
disa	CCI-001443, CCI-001444, CCI-002421, CCI-002418
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
ism	1315, 1319
iso27001-2013	A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2
nist	AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7
nist-csf	PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4
pcidss	Req-1.3.3
os-srg	SRG-OS-000299-GPOS-00117, SRG-OS-000300-GPOS-00118, SRG-OS-000424-GPOS-00188, SRG-OS-000481-GPOS-000481
cis	3.1.2
pcidss4	1.3.3, 1.3

Description

Deactivating wireless network interfaces should prevent normal usage of the wireless capability.

Configure the system to disable all wireless network interfaces with the following command:

$ sudo nmcli radio all off

Rationale

The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.

Verify Permissions and Ownership of Old Passwords File

Rule ID xccdf_org.ssgproject.content_rule_file_etc_security_opasswd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_etc_security_opasswd:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000200
os-srg	SRG-OS-000077-GPOS-00045
cis	7.1.10

Description

To properly set the owner of /etc/security/opasswd, run the command:

$ sudo chown root /etc/security/opasswd

To properly set the group owner of /etc/security/opasswd, run the command:

$ sudo chgrp root /etc/security/opasswd

To properly set the permissions of /etc/security/opasswd, run the command:

$ sudo chmod 0600 /etc/security/opasswd

Rationale

The /etc/security/opasswd file stores old passwords to prevent password reuse. Protection of this file is critical for system security.

OVAL test results details

/etc/security/opasswd is owned by root:root / 0600 oval:ssg-test_file_etc_security_opasswd:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Type	UID	GID	Size (B)	Permissions
true	/etc/security/opasswd	regular	0	0	0	`rw-------`

Verify Group Who Owns Backup group File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_backup_etc_group:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.4
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/group-, run the command:

$ sudo chgrp root /etc/group-

Rationale

The /etc/group- file is a backup file of /etc/group, and as such, it contains information regarding groups that are configured on the system. Protection of this file is important for system security.

OVAL test results details

Testing group ownership of /etc/group- oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/group-	oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1	oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1

Verify Group Who Owns Backup gshadow File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_backup_etc_gshadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.8

Description

To properly set the group owner of /etc/gshadow-, run the command:

$ sudo chgrp root /etc/gshadow-

Rationale

The /etc/gshadow- file is a backup of /etc/gshadow, and as such, it contains group password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing group ownership of /etc/gshadow- oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/gshadow-	oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1	oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1

Verify Group Who Owns Backup passwd File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_backup_etc_passwd:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.2
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/passwd-, run the command:

$ sudo chgrp root /etc/passwd-

Rationale

The /etc/passwd- file is a backup file of /etc/passwd, and as such, it contains information about the users that are configured on the system. Protection of this file is critical for system security.

OVAL test results details

Testing group ownership of /etc/passwd- oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/passwd-	oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1	oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1

Verify User Who Owns Backup shadow File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_backup_etc_shadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
pcidss	Req-8.7
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.6
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/shadow-, run the command:

$ sudo chgrp root /etc/shadow-

Rationale

The /etc/shadow- file is a backup file of /etc/shadow, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing group ownership of /etc/shadow- oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shadow-	oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1	oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1

Verify Group Who Owns group File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_etc_group

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_etc_group:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.3
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/group, run the command:

$ sudo chgrp root /etc/group

Rationale

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

OVAL test results details

Testing group ownership of /etc/group oval:ssg-test_file_groupowner_etc_group_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_etc_group_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/group	oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1	oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1

Verify Group Who Owns gshadow File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_etc_gshadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.7

Description

To properly set the group owner of /etc/gshadow, run the command:

$ sudo chgrp root /etc/gshadow

Rationale

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing group ownership of /etc/gshadow oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/gshadow	oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1	oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1

Verify Group Who Owns passwd File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_etc_passwd:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.1
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/passwd, run the command:

$ sudo chgrp root /etc/passwd

Rationale

The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.

OVAL test results details

Testing group ownership of /etc/passwd oval:ssg-test_file_groupowner_etc_passwd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_etc_passwd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/passwd	oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1	oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1

Verify Group Who Owns shadow File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_etc_shadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.5
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/shadow, run the command:

$ sudo chgrp root /etc/shadow

Rationale

The /etc/shadow file stores password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing group ownership of /etc/shadow oval:ssg-test_file_groupowner_etc_shadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_etc_shadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shadow	oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1	oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1

Verify Group Who Owns /etc/shells File

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_etc_shells:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

nist	AC-3, MP-2
anssi	R50
cis	7.1.9

Description

To properly set the group owner of /etc/shells, run the command:

$ sudo chgrp root /etc/shells

Rationale

The /etc/shells file contains the list of full pathnames to shells on the system. Since this file is used by many system programs this file should be protected.

OVAL test results details

Testing group ownership of /etc/shells oval:ssg-test_file_groupowner_etc_shells_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_etc_shells_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shells	oval:ssg-symlink_file_groupowner_etc_shells_uid_0:ste:1	oval:ssg-state_file_groupowner_etc_shells_gid_0_0:ste:1

Verify User Who Owns Backup group File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_backup_etc_group:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.4
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/group-, run the command:

$ sudo chown root /etc/group-

Rationale

OVAL test results details

Testing user ownership of /etc/group- oval:ssg-test_file_owner_backup_etc_group_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_backup_etc_group_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/group-	oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1	oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1

Verify User Who Owns Backup gshadow File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_backup_etc_gshadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.8

Description

To properly set the owner of /etc/gshadow-, run the command:

$ sudo chown root /etc/gshadow-

Rationale

The /etc/gshadow- file is a backup of /etc/gshadow, and as such, it contains group password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing user ownership of /etc/gshadow- oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/gshadow-	oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1	oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1

Verify User Who Owns Backup passwd File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_backup_etc_passwd:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.2
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/passwd-, run the command:

$ sudo chown root /etc/passwd-

Rationale

OVAL test results details

Testing user ownership of /etc/passwd- oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/passwd-	oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1	oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1

Verify Group Who Owns Backup shadow File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_backup_etc_shadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.6
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/shadow-, run the command:

$ sudo chown root /etc/shadow-

Rationale

The /etc/shadow- file is a backup file of /etc/shadow, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing user ownership of /etc/shadow- oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shadow-	oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1	oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1

Verify User Who Owns group File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_etc_group

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_etc_group:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.3
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/group, run the command:

$ sudo chown root /etc/group

Rationale

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

OVAL test results details

Testing user ownership of /etc/group oval:ssg-test_file_owner_etc_group_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_etc_group_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/group	oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1	oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1

Verify User Who Owns gshadow File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_etc_gshadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.7

Description

To properly set the owner of /etc/gshadow, run the command:

$ sudo chown root /etc/gshadow

Rationale

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing user ownership of /etc/gshadow oval:ssg-test_file_owner_etc_gshadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_etc_gshadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/gshadow	oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1	oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1

Verify User Who Owns passwd File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_etc_passwd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_etc_passwd:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.1
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/passwd, run the command:

$ sudo chown root /etc/passwd

Rationale

The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.

OVAL test results details

Testing user ownership of /etc/passwd oval:ssg-test_file_owner_etc_passwd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_etc_passwd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/passwd	oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1	oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1

Verify User Who Owns shadow File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_etc_shadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_etc_shadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.5
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/shadow, run the command:

$ sudo chown root /etc/shadow

Rationale

The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

OVAL test results details

Testing user ownership of /etc/shadow oval:ssg-test_file_owner_etc_shadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_etc_shadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shadow	oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1	oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1

Verify Who Owns /etc/shells File

Rule ID xccdf_org.ssgproject.content_rule_file_owner_etc_shells

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_etc_shells:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

nist	AC-3, MP-2
anssi	R50
cis	7.1.9

Description

To properly set the owner of /etc/shells, run the command:

$ sudo chown root /etc/shells

Rationale

The /etc/shells file contains the list of full pathnames to shells on the system. Since this file is used by many system programs this file should be protected.

OVAL test results details

Testing user ownership of /etc/shells oval:ssg-test_file_owner_etc_shells_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_etc_shells_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shells	oval:ssg-symlink_file_owner_etc_shells_uid_0:ste:1	oval:ssg-state_file_owner_etc_shells_uid_0_0:ste:1

Verify Permissions on Backup group File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_backup_etc_group:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.4
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/group-, run the command:

$ sudo chmod 0644 /etc/group-

Rationale

OVAL test results details

Testing mode of /etc/group- oval:ssg-test_file_permissions_backup_etc_group_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_backup_etc_group_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/group-	oval:ssg-exclude_symlinks__backup_etc_group:ste:1	oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1

Verify Permissions on Backup gshadow File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_backup_etc_gshadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.8

Description

To properly set the permissions of /etc/gshadow-, run the command:

$ sudo chmod 0000 /etc/gshadow-

Rationale

The /etc/gshadow- file is a backup of /etc/gshadow, and as such, it contains group password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing mode of /etc/gshadow- oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_backup_etc_gshadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/gshadow-	oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1	oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1

Verify Permissions on Backup passwd File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_backup_etc_passwd:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.2
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/passwd-, run the command:

$ sudo chmod 0644 /etc/passwd-

Rationale

OVAL test results details

Testing mode of /etc/passwd- oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_backup_etc_passwd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/passwd-	oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1	oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1

Verify Permissions on Backup shadow File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_backup_etc_shadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-000366
nist	AC-6 (1)
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
cis	7.1.6
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/shadow-, run the command:

$ sudo chmod 0000 /etc/shadow-

Rationale

The /etc/shadow- file is a backup file of /etc/shadow, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing mode of /etc/shadow- oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_backup_etc_shadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shadow-	oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1	oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1

Verify Permissions on group File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_etc_group

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_etc_group:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.3
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/group, run the command:

$ sudo chmod 0644 /etc/group

Rationale

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

OVAL test results details

Testing mode of /etc/group oval:ssg-test_file_permissions_etc_group_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_etc_group_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/group	oval:ssg-exclude_symlinks__etc_group:ste:1	oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1

Verify Permissions on gshadow File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_etc_gshadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.7

Description

To properly set the permissions of /etc/gshadow, run the command:

$ sudo chmod 0000 /etc/gshadow

Rationale

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

OVAL test results details

Testing mode of /etc/gshadow oval:ssg-test_file_permissions_etc_gshadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_etc_gshadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/gshadow	oval:ssg-exclude_symlinks__etc_gshadow:ste:1	oval:ssg-state_file_permissions_etc_gshadow_0_mode_0000or_stricter_:ste:1

Verify Permissions on passwd File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_etc_passwd:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.1
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/passwd, run the command:

$ sudo chmod 0644 /etc/passwd

Rationale

If the /etc/passwd file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.

OVAL test results details

Testing mode of /etc/passwd oval:ssg-test_file_permissions_etc_passwd_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_etc_passwd_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/passwd	oval:ssg-exclude_symlinks__etc_passwd:ste:1	oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1

Verify Permissions on shadow File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_etc_shadow:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.2.2
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-8.7.c
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	7.1.5
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/shadow, run the command:

$ sudo chmod 0000 /etc/shadow

Rationale

OVAL test results details

Testing mode of /etc/shadow oval:ssg-test_file_permissions_etc_shadow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_etc_shadow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shadow	oval:ssg-exclude_symlinks__etc_shadow:ste:1	oval:ssg-state_file_permissions_etc_shadow_0_mode_0000or_stricter_:ste:1

Verify Permissions on /etc/shells File

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_etc_shells

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_etc_shells:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

nist	AC-3, MP-2
anssi	R50
cis	7.1.9

Description

To properly set the permissions of /etc/shells, run the command:

$ sudo chmod 0644 /etc/shells

Rationale

The /etc/shells file contains the list of full pathnames to shells on the system. Since this file is used by many system programs this file should be protected.

OVAL test results details

Testing mode of /etc/shells oval:ssg-test_file_permissions_etc_shells_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_etc_shells_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/shells	oval:ssg-exclude_symlinks__etc_shells:ste:1	oval:ssg-state_file_permissions_etc_shells_0_mode_0644or_stricter_:ste:1

Verify that All World-Writable Directories Have Sticky Bits Set

Rule ID xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-dir_perms_world_writable_sticky_bits:def:1

Time 2025-06-26T17:28:34+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-001090
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000138-GPOS-00069
anssi	R54
cis	7.1.11
pcidss4	2.2.6, 2.2

Description

When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes.
To set the sticky bit on a world-writable directory DIR, run the following command:

$ sudo chmod +t DIR

Rationale

Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure.

The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as /tmp), and for directories requiring global read/write access.

Warnings

warning This rule can take a long time to perform the check and might consume a considerable amount of resources depending on the number of directories present on the system. It is not a problem in most cases, but especially systems with a large number of directories can be affected. See https://access.redhat.com/articles/6999111.

OVAL test results details

Check the existence of world-writable directories without sticky bits oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_dir_perms_world_writable_sticky_bits:obj:1 of type file_object

Behaviors

Path

Filename

Filter

/boot/efi

/boot

no value

oval:ssg-state_dir_perms_world_writable_sticky_bits:ste:1

Ensure No World-Writable Files Exist

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_unauthorized_world_writable:def:1

Time 2025-06-26T17:28:38+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
anssi	R54
cis	7.1.11
pcidss4	2.2.6, 2.2

Description

It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. Finally, this applies to real files and not virtual files that are a part of pseudo file systems such as sysfs or procfs.

Rationale

Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.

Warnings

warning This rule can take a long time to perform the check and might consume a considerable amount of resources depending on the number of files present on the system. It is not a problem in most cases, but especially systems with a large number of files can be affected. See https://access.redhat.com/articles/6999111.

OVAL test results details

Check the existence of world-writable files oval:ssg-test_file_permissions_unauthorized_world_write:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_unauthorized_world_write:obj:1 of type file_object

Behaviors

Path

Filename

Filter

/boot/efi

/boot

no value

^.*$

oval:ssg-state_file_permissions_unauthorized_world_write:ste:1

oval:ssg-state_file_permissions_unauthorized_world_write_special_selinux_files:ste:1

oval:ssg-state_file_permissions_unauthorized_world_write_sysroot:ste:1

Ensure All Files Are Owned by a Group

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_ungroupowned:def:1

Time 2025-06-26T17:28:47+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.06, DSS06.10
disa	CCI-000366
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R53
cis	7.1.12
pcidss4	2.2.6, 2.2

Description

If any file is not group-owned by a valid defined group, the cause of the lack of group-ownership must be investigated. Following this, those files should be deleted or assigned to an appropriate group. The groups need to be defined in /etc/group or in /usr/lib/group if nss-altfiles are configured to be used in /etc/nsswitch.conf. Locate the mount points related to local devices by the following command:

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

For all mount points listed by the previous command, it is necessary to search for files which do not belong to a valid group using the following command:

$ sudo find MOUNTPOINT -xdev -nogroup 2>/dev/null

Rationale

Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account, or other similar cases. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.

Warnings

warning This rule only considers local groups as valid groups. If you have your groups defined outside /etc/group or /usr/lib/group, the rule won't consider those.

OVAL test results details

Test if /etc/nssswitch.conf contains 'altfiles' in 'group' key oval:ssg-test_file_permissions_ungroupowned_nsswitch_uses_altfiles:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
false	/etc/nsswitch.conf	group: files [SUCCESS=merge] sss [SUCCESS=merge] systemd

there are no files with group owner different than local groups oval:ssg-test_file_permissions_ungroupowned:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_ungroupowned:obj:1 of type file_object

Behaviors

Path

Filename

Filter

/
/boot/efi
/boot
39
50
20
54
63
33
190
997
81
996
59
995
994
100
65534
22
35
999
36
998
0
2
7
6
3
19
8
1
18
9
4
74
993
992
991
32
990
989
29
72
1000
15
5
12
11
10
988

no value

oval:ssg-state_file_permissions_ungroupowned_local_group_owner:ste:1

oval:ssg-state_file_permissions_ungroupowned_sysroot:ste:1

Test if /etc/nssswitch.conf contains 'altfiles' in 'group' key oval:ssg-test_file_permissions_ungroupowned_nsswitch_uses_altfiles:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
false	/etc/nsswitch.conf	group: files [SUCCESS=merge] sss [SUCCESS=merge] systemd

there are no files with group owner different than local groups oval:ssg-test_file_permissions_ungroupowned_with_usrlib:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_ungroupowned_with_usrlib:obj:1 of type file_object

Behaviors

Path

Filename

Filter

/
/boot/efi
/boot
39
50
20
54
63
33
190
997
81
996
59
995
994
100
65534
22
35
999
36
998
0
2
7
6
3
19
8
1
18
9
4
74
993
992
991
32
990
989
29
72
1000
15
5
12
11
10
988

no value

oval:ssg-state_file_permissions_ungroupowned_local_group_owner_with_usrlib:ste:1

oval:ssg-state_file_permissions_ungroupowned_sysroot:ste:1

Ensure All Files Are Owned by a User

Rule ID xccdf_org.ssgproject.content_rule_no_files_unowned_by_user

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-no_files_unowned_by_user:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	11, 12, 13, 14, 15, 16, 18, 3, 5, 9
cobit5	APO01.06, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06
disa	CCI-000366
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
anssi	R53
cis	7.1.12
pcidss4	2.2.6, 2.2

Description

If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. Locate the mount points related to local devices by the following command:

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

For all mount points listed by the previous command, it is necessary to search for files which do not belong to a valid user using the following command:

$ sudo find MOUNTPOINT -xdev -nouser 2>/dev/null

Rationale

Warnings

warning For this rule to evaluate centralized user accounts, getent must be working properly so that running the command

getent passwd

returns a list of all users in your organization. If using the System Security Services Daemon (SSSD),

enumerate = true

must be configured in your organization's domain to return a complete list of users

OVAL test results details

there are no files without a known owner oval:ssg-test_no_files_unowned_by_user:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_no_files_unowned_by_user:obj:1 of type file_object

Behaviors

Path

Filename

Filter

0
29
72
988
999
81
14
65534
59
998
997
74
992
991
32
990
989
7
12
6
8
11
5
4
3
2
1
/
/boot/efi
/boot

no value

oval:ssg-state_no_files_unowned_by_user_uids_list:ste:1

Disable the Automounter

Rule ID xccdf_org.ssgproject.content_rule_service_autofs_disabled

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cobit5	APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.4.6
disa	CCI-000778, CCI-000366, CCI-001958
hipaa	164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b)
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6
iso27001-2013	A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	CM-7(a), CM-7(b), CM-6(a), MP-7
nist-csf	PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7
os-srg	SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227
cis	2.1.1

Description

The autofs daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as /misc/cd. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing /etc/fstab rather than relying on the automounter.

The autofs service can be disabled with the following command:

$ sudo systemctl mask --now autofs.service

Rationale

Disabling the automounter permits the administrator to statically control filesystem mounting through /etc/fstab.

Additionally, automatically mounting filesystems permits easy introduction of unknown devices, thereby facilitating malicious activity.

Disable Mounting of cramfs

Rule ID xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-kernel_module_cramfs_disabled:def:1

Time 2025-06-26T17:28:51+00:00

Severity low

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.4.6
disa	CCI-000381
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
os-srg	SRG-OS-000095-GPOS-00049
cis	1.1.1.1

Description

To configure the system to prevent the cramfs kernel module from being loaded, add the following line to the file /etc/modprobe.d/cramfs.conf:

install cramfs /bin/false

This effectively prevents usage of this uncommon filesystem. The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A cramfs image can be used without having to first decompress the image.

Rationale

Removing support for unneeded filesystem types reduces the local attack surface of the server.

OVAL test results details

kernel module cramfs disabled oval:ssg-test_kernmod_cramfs_disabled:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/modprobe.d/cramfs.conf	install cramfs /bin/false

kernel module cramfs disabled in /etc/modprobe.conf oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/modprobe.conf	^\s*install\s+cramfs\s+(/bin/false\|/bin/true)$	1

Disable Mounting of freevxfs

Rule ID xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-kernel_module_freevxfs_disabled:def:1

Time 2025-06-26T17:28:51+00:00

Severity low

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.4.6
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	1.1.1.2

Description

To configure the system to prevent the freevxfs kernel module from being loaded, add the following line to the file /etc/modprobe.d/freevxfs.conf:

install freevxfs /bin/false

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

OVAL test results details

kernel module freevxfs disabled oval:ssg-test_kernmod_freevxfs_disabled:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/modprobe.d/freevxfs.conf	install freevxfs /bin/false

kernel module freevxfs disabled in /etc/modprobe.conf oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/modprobe.conf	^\s*install\s+freevxfs\s+(/bin/false\|/bin/true)$	1

Disable Mounting of hfs

Rule ID xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-kernel_module_hfs_disabled:def:1

Time 2025-06-26T17:28:51+00:00

Severity low

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.4.6
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	1.1.1.3

Description

To configure the system to prevent the hfs kernel module from being loaded, add the following line to the file /etc/modprobe.d/hfs.conf:

install hfs /bin/false

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

OVAL test results details

kernel module hfs disabled oval:ssg-test_kernmod_hfs_disabled:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/modprobe.d/hfs.conf	install hfs /bin/false

kernel module hfs disabled in /etc/modprobe.conf oval:ssg-test_kernmod_hfs_modprobeconf:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/modprobe.conf	^\s*install\s+hfs\s+(/bin/false\|/bin/true)$	1

Disable Mounting of hfsplus

Rule ID xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-kernel_module_hfsplus_disabled:def:1

Time 2025-06-26T17:28:51+00:00

Severity low

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.4.6
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	1.1.1.4

Description

To configure the system to prevent the hfsplus kernel module from being loaded, add the following line to the file /etc/modprobe.d/hfsplus.conf:

install hfsplus /bin/false

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

OVAL test results details

kernel module hfsplus disabled oval:ssg-test_kernmod_hfsplus_disabled:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/modprobe.d/hfsplus.conf	install hfsplus /bin/false

kernel module hfsplus disabled in /etc/modprobe.conf oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/modprobe.conf	^\s*install\s+hfsplus\s+(/bin/false\|/bin/true)$	1

Disable Mounting of jffs2

Rule ID xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-kernel_module_jffs2_disabled:def:1

Time 2025-06-26T17:28:51+00:00

Severity low

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
cui	3.4.6
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	1.1.1.5

Description

To configure the system to prevent the jffs2 kernel module from being loaded, add the following line to the file /etc/modprobe.d/jffs2.conf:

install jffs2 /bin/false

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

OVAL test results details

kernel module jffs2 disabled oval:ssg-test_kernmod_jffs2_disabled:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/modprobe.d/jffs2.conf	install jffs2 /bin/false

kernel module jffs2 disabled in /etc/modprobe.conf oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/modprobe.conf	^\s*install\s+jffs2\s+(/bin/false\|/bin/true)$	1

Disable Modprobe Loading of USB Storage Driver

Rule ID xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-kernel_module_usb-storage_disabled:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	1, 12, 15, 16, 5
cobit5	APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.1.21
disa	CCI-000778, CCI-001958, CCI-003959
hipaa	164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b)
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6
iso27001-2013	A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3
nist	CM-7(a), CM-7(b), CM-6(a), MP-7
nist-csf	PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7
os-srg	SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227
app-srg-ctr	SRG-APP-000141-CTR-000315
cis	1.1.1.8
pcidss4	3.4.2, 3.4

Description

To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the usb-storage kernel module from being loaded, add the following line to the file /etc/modprobe.d/usb-storage.conf:

install usb-storage /bin/false

This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.

Rationale

USB storage devices such as thumb drives can be used to introduce malicious software.

OVAL test results details

kernel module usb-storage disabled oval:ssg-test_kernmod_usb-storage_disabled:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/modprobe.d/usb-storage.conf	install usb-storage /bin/false

kernel module usb-storage disabled in /etc/modprobe.conf oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/modprobe.conf	^\s*install\s+usb-storage\s+(/bin/false\|/bin/true)$	1

Add nodev Option to /dev/shm

Rule ID xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-mount_option_dev_shm_nodev:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	11, 13, 14, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06
disa	CCI-001764
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.2.2

Description

The nodev mount option can be used to prevent creation of device files in /dev/shm. Legitimate character and block devices should not exist within temporary directories like /dev/shm. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /dev/shm.

Rationale

The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.

OVAL test results details

nodev on /dev/shm oval:ssg-test_dev_shm_partition_nodev_expected:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Mount point	Device	Uuid	Fs type	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Total space	Space used	Space left
true	/dev/shm	tmpfs		tmpfs	rw	seclabel	nosuid	nodev	noexec	inode64	252150	0	252150

/dev/shm exists oval:ssg-test_dev_shm_partition_nodev_expected_exist:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Mount point	Device	Uuid	Fs type	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Total space	Space used	Space left
not evaluated	/dev/shm	tmpfs		tmpfs	rw	seclabel	nosuid	nodev	noexec	inode64	252150	0	252150

nodev on /dev/shm in /etc/fstab oval:ssg-test_dev_shm_partition_nodev_expected_in_fstab:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/fstab	tmpfs /dev/shm tmpfs defaults,nosuid,inode64,nodev,noexec

Add noexec Option to /dev/shm

Rule ID xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-mount_option_dev_shm_noexec:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	11, 13, 14, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06
disa	CCI-001764
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.2.4

Description

The noexec mount option can be used to prevent binaries from being executed out of /dev/shm. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as /dev/shm. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of /dev/shm.

Rationale

Allowing users to execute binaries from world-writable directories such as /dev/shm can expose the system to potential compromise.

OVAL test results details

noexec on /dev/shm oval:ssg-test_dev_shm_partition_noexec_expected:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Mount point	Device	Uuid	Fs type	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Total space	Space used	Space left
true	/dev/shm	tmpfs		tmpfs	rw	seclabel	nosuid	nodev	noexec	inode64	252150	0	252150

/dev/shm exists oval:ssg-test_dev_shm_partition_noexec_expected_exist:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Mount point	Device	Uuid	Fs type	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Total space	Space used	Space left
not evaluated	/dev/shm	tmpfs		tmpfs	rw	seclabel	nosuid	nodev	noexec	inode64	252150	0	252150

noexec on /dev/shm in /etc/fstab oval:ssg-test_dev_shm_partition_noexec_expected_in_fstab:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/fstab	tmpfs /dev/shm tmpfs defaults,nosuid,inode64,nodev,noexec

Add nosuid Option to /dev/shm

Rule ID xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-mount_option_dev_shm_nosuid:def:1

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	11, 13, 14, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06
disa	CCI-001764
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.2.3

Description

The nosuid mount option can be used to prevent execution of setuid programs in /dev/shm. The SUID and SGID permissions should not be required in these world-writable directories. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /dev/shm.

Rationale

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

OVAL test results details

nosuid on /dev/shm oval:ssg-test_dev_shm_partition_nosuid_expected:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Mount point	Device	Uuid	Fs type	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Total space	Space used	Space left
true	/dev/shm	tmpfs		tmpfs	rw	seclabel	nosuid	nodev	noexec	inode64	252150	0	252150

/dev/shm exists oval:ssg-test_dev_shm_partition_nosuid_expected_exist:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Mount point	Device	Uuid	Fs type	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Total space	Space used	Space left
not evaluated	/dev/shm	tmpfs		tmpfs	rw	seclabel	nosuid	nodev	noexec	inode64	252150	0	252150

nosuid on /dev/shm in /etc/fstab oval:ssg-test_dev_shm_partition_nosuid_expected_in_fstab:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/fstab	tmpfs /dev/shm tmpfs defaults,nosuid,inode64,nodev,noexec

Add nodev Option to /home

Rule ID xccdf_org.ssgproject.content_rule_mount_option_home_nodev

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity unknown

References:

disa	CCI-001764
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.3.2

Description

The nodev mount option can be used to prevent device files from being created in /home. Legitimate character and block devices should exist only in the /dev directory on the root partition or within chroot jails built for system services. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /home.

Rationale

The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.

Add nosuid Option to /home

Rule ID xccdf_org.ssgproject.content_rule_mount_option_home_nosuid

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	11, 13, 14, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06
disa	CCI-000366, CCI-001764
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227
anssi	R28
cis	1.1.2.3.3

Description

The nosuid mount option can be used to prevent execution of setuid programs in /home. The SUID and SGID permissions should not be required in these user data directories. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /home.

Rationale

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from user home directory partitions.

Add nodev Option to /tmp

Rule ID xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	11, 13, 14, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06
disa	CCI-001764
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.1.2

Description

The nodev mount option can be used to prevent device files from being created in /tmp. Legitimate character and block devices should not exist within temporary directories like /tmp. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /tmp.

Rationale

The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /tmp

Rule ID xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	11, 13, 14, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06
disa	CCI-001764
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
anssi	R28
cis	1.1.2.1.4

Description

The noexec mount option can be used to prevent binaries from being executed out of /tmp. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of /tmp.

Rationale

Allowing users to execute binaries from world-writable directories such as /tmp should never be necessary in normal operation and can expose the system to potential compromise.

Add nosuid Option to /tmp

Rule ID xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

cis-csc	11, 13, 14, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06
disa	CCI-001764
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
anssi	R28
cis	1.1.2.1.3

Description

The nosuid mount option can be used to prevent execution of setuid programs in /tmp. The SUID and SGID permissions should not be required in these world-writable directories. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /tmp.

Rationale

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

Add nodev Option to /var/log/audit

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-001764
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
ospp	FMT_SMF_EXT.1
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.7.2

Description

The nodev mount option can be used to prevent device files from being created in /var/log/audit. Legitimate character and block devices should exist only in the /dev directory on the root partition or within chroot jails built for system services. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /var/log/audit.

Rationale

The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /var/log/audit

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-001764
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
ospp	FMT_SMF_EXT.1
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.7.4

Description

The noexec mount option can be used to prevent binaries from being executed out of /var/log/audit. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of /var/log/audit.

Rationale

Allowing users to execute binaries from directories containing audit log files such as /var/log/audit should never be necessary in normal operation and can expose the system to potential compromise.

Add nosuid Option to /var/log/audit

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-001764
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
ospp	FMT_SMF_EXT.1
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.7.3

Description

The nosuid mount option can be used to prevent execution of setuid programs in /var/log/audit. The SUID and SGID permissions should not be required in directories containing audit log files. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /var/log/audit.

Rationale

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for audit log files.

Add nodev Option to /var/log

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-001764
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.6.2

Description

The nodev mount option can be used to prevent device files from being created in /var/log. Legitimate character and block devices should exist only in the /dev directory on the root partition or within chroot jails built for system services. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /var/log.

Rationale

The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /var/log

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-001764
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
anssi	R28
cis	1.1.2.6.4

Description

The noexec mount option can be used to prevent binaries from being executed out of /var/log. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of /var/log.

Rationale

Allowing users to execute binaries from directories containing log files such as /var/log should never be necessary in normal operation and can expose the system to potential compromise.

Add nosuid Option to /var/log

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:51+00:00

Severity medium

References:

disa	CCI-001764
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
anssi	R28
cis	1.1.2.6.3

Description

The nosuid mount option can be used to prevent execution of setuid programs in /var/log. The SUID and SGID permissions should not be required in directories containing log files. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /var/log.

Rationale

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for log files.

Add nodev Option to /var

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_nodev

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

disa	CCI-001764
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7
nist-csf	PR.IP-1, PR.PT-2, PR.PT-3
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.4.2

Description

The nodev mount option can be used to prevent device files from being created in /var. Legitimate character and block devices should exist only in the /dev directory on the root partition or within chroot jails built for system services. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /var.

Rationale

The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.

Add nosuid Option to /var

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_nosuid

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

anssi	R28
cis	1.1.2.4.3

Description

The nosuid mount option can be used to prevent execution of setuid programs in /var. The SUID and SGID permissions should not be required for this directory. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /var.

Rationale

The presence of SUID and SGID executables should be tightly controlled.

Add nodev Option to /var/tmp

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

disa	CCI-001764
os-srg	SRG-OS-000368-GPOS-00154
cis	1.1.2.5.2

Description

The nodev mount option can be used to prevent device files from being created in /var/tmp. Legitimate character and block devices should not exist within temporary directories like /var/tmp. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /var/tmp.

Rationale

The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /var/tmp

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

disa	CCI-001764
os-srg	SRG-OS-000368-GPOS-00154
anssi	R28
cis	1.1.2.5.4

Description

The noexec mount option can be used to prevent binaries from being executed out of /var/tmp. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of /var/tmp.

Rationale

Allowing users to execute binaries from world-writable directories such as /var/tmp should never be necessary in normal operation and can expose the system to potential compromise.

Add nosuid Option to /var/tmp

Rule ID xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

disa	CCI-001764
os-srg	SRG-OS-000368-GPOS-00154
anssi	R28
cis	1.1.2.5.3

Description

The nosuid mount option can be used to prevent execution of setuid programs in /var/tmp. The SUID and SGID permissions should not be required in these world-writable directories. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /var/tmp.

Rationale

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

Disable core dump backtraces

Rule ID xccdf_org.ssgproject.content_rule_coredump_disable_backtraces

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-coredump_disable_backtraces:def:1

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

disa	CCI-000366
nist	CM-6
pcidss	Req-3.2
os-srg	SRG-OS-000480-GPOS-00227
cis	1.5.3
pcidss4	3.3.1.1, 3.3.1, 3.3

Description

The ProcessSizeMax option in [Coredump] section of /etc/systemd/coredump.conf specifies the maximum size in bytes of a core which will be processed. Core dumps exceeding this size may be stored, but the backtrace will not be generated.

Rationale

A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended, however there may be overriding operational requirements to enable advanced debuging. Permitting temporary enablement of core dumps during such situations should be reviewed through local needs and policy.

Warnings

warning If the /etc/systemd/coredump.conf file does not already contain the [Coredump] section, the value will not be configured correctly.

OVAL test results details

tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file oval:ssg-test_coredump_disable_backtraces:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/systemd/coredump.conf	[Coredump] Storage=none #Storage=external #Compress=yes ProcessSizeMax=0

tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf.d file oval:ssg-test_coredump_disable_backtraces_config_dir:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_coredump_disable_backtraces_config_dir:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/systemd/coredump.conf.d	.*\.conf$	^\s\[Coredump\].(?:\n\s[^[\s].)\n^[ \t](?i)ProcessSizeMax(?-i)[ \t]=[ \t](.+?)[ \t]*(?:$\|#)	1

Disable storing core dump

Rule ID xccdf_org.ssgproject.content_rule_coredump_disable_storage

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-coredump_disable_storage:def:1

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

disa	CCI-000366
nist	CM-6
pcidss	Req-3.2
os-srg	SRG-OS-000480-GPOS-00227
cis	1.5.4
pcidss4	3.3.1.1, 3.3.1, 3.3

Description

The Storage option in [Coredump] sectionof /etc/systemd/coredump.conf can be set to none to disable storing core dumps permanently.

Rationale

Warnings

warning If the /etc/systemd/coredump.conf file does not already contain the [Coredump] section, the value will not be configured correctly.

OVAL test results details

tests the value of Storage setting in the /etc/systemd/coredump.conf file oval:ssg-test_coredump_disable_storage:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/systemd/coredump.conf	[Coredump] Storage=none

tests the value of Storage setting in the /etc/systemd/coredump.conf.d file oval:ssg-test_coredump_disable_storage_config_dir:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_coredump_disable_storage_config_dir:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/systemd/coredump.conf.d	.*\.conf$	^\s\[Coredump\].(?:\n\s[^[\s].)\n^[ \t](?i)Storage(?-i)[ \t]=[ \t](.+?)[ \t]*(?:$\|#)	1

Enable Randomized Layout of Virtual Address Space

Rule ID xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_kernel_randomize_va_space:def:1

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

cui	3.1.7
disa	CCI-000366, CCI-002824
hipaa	164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e)
nerc-cip	CIP-002-5 R1.1, CIP-002-5 R1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 4.1, CIP-004-6 4.2, CIP-004-6 R2.2.3, CIP-004-6 R2.2.4, CIP-004-6 R2.3, CIP-004-6 R4, CIP-005-6 R1, CIP-005-6 R1.1, CIP-005-6 R1.2, CIP-007-3 R3, CIP-007-3 R3.1, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, CIP-007-3 R8.4, CIP-009-6 R.1.1, CIP-009-6 R4
nist	SC-30, SC-30(2), CM-6(a)
pcidss	Req-2.2.1
os-srg	SRG-OS-000433-GPOS-00193, SRG-OS-000480-GPOS-00227
app-srg-ctr	SRG-APP-000450-CTR-001105
anssi	R9
cis	1.5.1
pcidss4	3.3.1.1, 3.3.1, 3.3

Description

To set the runtime status of the kernel.randomize_va_space kernel parameter, run the following command:

$ sudo sysctl -w kernel.randomize_va_space=2

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

kernel.randomize_va_space = 2

Rationale

Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques.

OVAL test results details

kernel.randomize_va_space static configuration oval:ssg-test_sysctl_kernel_randomize_va_space_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	kernel.randomize_va_space = 2
true	/etc/sysctl.d/99-sysctl.conf	kernel.randomize_va_space = 2

kernel.randomize_va_space static configuration oval:ssg-test_sysctl_kernel_randomize_va_space_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	kernel.randomize_va_space = 2
not evaluated	/etc/sysctl.d/99-sysctl.conf	kernel.randomize_va_space = 2

kernel.randomize_va_space static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_kernel_randomize_va_space_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]kernel.randomize_va_space[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter kernel.randomize_va_space set to 2 oval:ssg-test_sysctl_kernel_randomize_va_space_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	kernel.randomize_va_space	2

Restrict usage of ptrace to descendant processes

Rule ID xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

disa	CCI-000366, CCI-001082
nist	SC-7(10)
ospp	FMT_SMF_EXT.1
os-srg	SRG-OS-000132-GPOS-00067, SRG-OS-000480-GPOS-00227
anssi	R11
cis	1.5.2

Description

To set the runtime status of the kernel.yama.ptrace_scope kernel parameter, run the following command:

$ sudo sysctl -w kernel.yama.ptrace_scope=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

kernel.yama.ptrace_scope = 1

Rationale

Unrestricted usage of ptrace allows compromised binaries to run ptrace on another processes of the user. Like this, the attacker can steal sensitive information from the target processes (e.g. SSH sessions, web browser, ...) without any additional assistance from the user (i.e. without resorting to phishing).

OVAL test results details

kernel.yama.ptrace_scope static configuration oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	kernel.yama.ptrace_scope = 1
true	/etc/sysctl.d/99-sysctl.conf	kernel.yama.ptrace_scope = 1

kernel.yama.ptrace_scope static configuration oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_user_missing:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/sysctl.conf	kernel.yama.ptrace_scope = 1
not evaluated	/etc/sysctl.d/99-sysctl.conf	kernel.yama.ptrace_scope = 1

kernel.yama.ptrace_scope static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]kernel.yama.ptrace_scope[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter kernel.yama.ptrace_scope set to 1 oval:ssg-test_sysctl_kernel_yama_ptrace_scope_runtime:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Value
true	kernel.yama.ptrace_scope	1

Install libselinux Package

Rule ID xccdf_org.ssgproject.content_rule_package_libselinux_installed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_libselinux_installed:def:1

Time 2025-06-26T17:28:52+00:00

Severity high

References:

cis	1.3.1.1
pcidss4	1.2.6, 1.2

Description

The libselinux package can be installed with the following command:

$ sudo dnf install libselinux

Rationale

Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The libselinux package contains the core library of the Security-enhanced Linux system.

OVAL test results details

package libselinux is installed oval:ssg-test_package_libselinux_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	libselinux	x86_64	(none)	3.el9	3.6	0:3.6-3.el9	d36cb86cb86b3716	libselinux-0:3.6-3.el9.x86_64

Uninstall mcstrans Package

Rule ID xccdf_org.ssgproject.content_rule_package_mcstrans_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_mcstrans_removed:def:1

Time 2025-06-26T17:28:52+00:00

Severity low

References:

cis	1.3.1.7

Description

The mcstransd daemon provides category label information to client processes requesting information. The label translations are defined in /etc/selinux/targeted/setrans.conf. The mcstrans package can be removed with the following command:

$ sudo dnf remove mcstrans

Rationale

Since this service is not used very often, disable it to reduce the amount of potentially vulnerable code running on the system.

OVAL test results details

package mcstrans is removed oval:ssg-test_package_mcstrans_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_mcstrans_removed:obj:1 of type rpminfo_object

Name
mcstrans

Uninstall setroubleshoot Package

Rule ID xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_setroubleshoot_removed:def:1

Time 2025-06-26T17:28:52+00:00

Severity low

References:

anssi	R49
cis	1.3.1.8

Description

The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The setroubleshoot package can be removed with the following command:

$ sudo dnf remove setroubleshoot

Rationale

The SETroubleshoot service is an unnecessary daemon to have running on a server, especially if X Windows is removed or disabled.

OVAL test results details

package setroubleshoot is removed oval:ssg-test_package_setroubleshoot_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_setroubleshoot_removed:obj:1 of type rpminfo_object

Name
setroubleshoot

Ensure SELinux Not Disabled in /etc/default/grub

Rule ID xccdf_org.ssgproject.content_rule_grub2_enable_selinux

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-grub2_enable_selinux:def:1

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9
cobit5	APO01.06, APO11.04, APO13.01, BAI03.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, MEA02.01
cui	3.1.2, 3.7.2
disa	CCI-000022, CCI-000032
hipaa	164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e)
isa-62443-2009	4.2.3.4, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	AC-3, AC-3(3)(a)
nist-csf	DE.AE-1, ID.AM-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.DS-5, PR.PT-1, PR.PT-3, PR.PT-4
cis	1.3.1.2
pcidss4	1.2.6, 1.2

Description

SELinux can be disabled at boot time by an argument in /etc/default/grub. Remove any instances of selinux=0 from the kernel arguments in that file to prevent SELinux from being disabled at boot.

Rationale

Disabling a major host protection feature, such as SELinux, at boot time prevents it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation.

OVAL test results details

check value selinux|enforcing=0 in /etc/default/grub, fail if found oval:ssg-test_selinux_default_grub:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_selinux_default_grub:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/default/grub	^[\s]GRUB_CMDLINE_LINUX.(selinux\|enforcing)=0.*$	1

check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found oval:ssg-test_selinux_grub2_cfg:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_selinux_grub2_cfg:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/grub2.cfg	^.(selinux\|enforcing)=0.$	1

check value selinux|enforcing=0 in /etc/grub.d fail if found oval:ssg-test_selinux_grub_dir:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_selinux_grub_dir:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/grub.d	^.*$	^.(selinux\|enforcing)=0.$	1

Ensure SELinux is Not Disabled

Rule ID xccdf_org.ssgproject.content_rule_selinux_not_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-selinux_not_disabled:def:1

Time 2025-06-26T17:28:52+00:00

Severity high

References:

cis	1.3.1.4

Description

The SELinux state should be set to enforcing or permissive at system boot time. In the file /etc/selinux/config, add or correct the following line to configure the system to boot into enforcing or permissive mode:

SELINUX=enforcing

SELINUX=permissive

Rationale

Running SELinux in disabled mode is strongly discouraged. It prevents enforcing the SELinux controls without a system reboot. It also avoids labeling any persistent objects such as files, making it difficult to enable SELinux in the future.

Warnings

warning In case the SELinux is "disabled", the automated remediation will adopt a more conservative approach and set it to "permissive" in order to avoid any system disruption and give the administrator the opportunity to assess the impact and necessary efforts before setting it to "enforcing", which is strongly recommended.

OVAL test results details

SELinux is not disabled in /etc/selinux/config oval:ssg-test_selinux_not_disabled:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/selinux/config	SELINUX=enforcing

Configure SELinux Policy

Rule ID xccdf_org.ssgproject.content_rule_selinux_policytype

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-selinux_policytype:def:1

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9
cobit5	APO01.06, APO11.04, APO13.01, BAI03.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, MEA02.01
cui	3.1.2, 3.7.2
disa	CCI-002696
hipaa	164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e)
isa-62443-2009	4.2.3.4, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.2, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-004-6 R3.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, CIP-007-3 R6.5
nist	AC-3, AC-3(3)(a), AU-9, SC-7(21)
nist-csf	DE.AE-1, ID.AM-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.DS-5, PR.PT-1, PR.PT-3, PR.PT-4
ospp	FMT_MOF_EXT.1
os-srg	SRG-OS-000445-GPOS-00199
app-srg-ctr	SRG-APP-000233-CTR-000585
anssi	R46, R64
bsi	APP.4.4.A4, SYS.1.6.A3, SYS.1.6.A18, SYS.1.6.A21
cis	1.3.1.3
pcidss4	1.2.6, 1.2

Description

The SELinux targeted policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in /etc/selinux/config:

SELINUXTYPE=targeted

Other policies, such as mls, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.

Rationale

Setting the SELinux policy to targeted or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services.

Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in permissive mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to targeted.

OVAL test results details

Tests the value of the ^[\s]SELINUXTYPE[\s]=[\s]([^#]) expression in the /etc/selinux/config file oval:ssg-test_selinux_policy:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/selinux/config	SELINUXTYPE=targeted

Disable Avahi Server Software

Rule ID xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:52+00:00

Severity medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	2.1.2
pcidss4	2.2.4, 2.2

Description

The avahi-daemon service can be disabled with the following command:

$ sudo systemctl mask --now avahi-daemon.service

Rationale

Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted.

Ensure that /etc/at.deny does not exist

Rule ID xccdf_org.ssgproject.content_rule_file_at_deny_not_exist

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_at_deny_not_exist:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis	2.4.2.1
pcidss4	2.2.6, 2.2

Description

The file /etc/at.deny should not exist. Use /etc/at.allow instead.

Rationale

Access to at should be restricted. It is easier to manage an allow list than a deny list.

OVAL test results details

Test that that /etc/at.deny does not exist oval:ssg-test_file_at_deny_not_exist:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_at_deny_not_exist:obj:1 of type file_object

Filepath
/etc/at.deny

Ensure that /etc/cron.allow exists

Rule ID xccdf_org.ssgproject.content_rule_file_cron_allow_exists

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_cron_allow_exists:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis	2.4.1.8

Description

The file /etc/cron.allow should exist and should be used instead of /etc/cron.deny.

Rationale

Access to crontab should be restricted. It is easier to manage an allow list than a deny list. Therefore, /etc/cron.allow needs to be created and used instead of /etc/cron.deny. Regardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab.

OVAL test results details

Test that that /etc/cron.allow does exist oval:ssg-test_file_cron_allow_exists:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Type	UID	GID	Size (B)	Permissions
not evaluated	/etc/cron.allow	regular	0	0	0	`rw-------`

Ensure that /etc/cron.deny does not exist

Rule ID xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_cron_deny_not_exist:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis	2.4.1.8
pcidss4	2.2.6, 2.2

Description

The file /etc/cron.deny should not exist. Use /etc/cron.allow instead.

Rationale

Access to cron should be restricted. It is easier to manage an allow list than a deny list.

OVAL test results details

Test that that /etc/cron.deny does not exist oval:ssg-test_file_cron_deny_not_exist:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_cron_deny_not_exist:obj:1 of type file_object

Filepath
/etc/cron.deny

Verify Group Who Owns /etc/at.allow file

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_at_allow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_at_allow:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis	2.4.2.1
pcidss4	2.2.6, 2.2

Description

If /etc/at.allow exists, it must be group-owned by root. To properly set the group owner of /etc/at.allow, run the command:

$ sudo chgrp root /etc/at.allow

Rationale

If the owner of the at.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.

OVAL test results details

Testing group ownership of /etc/at.allow oval:ssg-test_file_groupowner_at_allow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_at_allow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/at.allow	oval:ssg-symlink_file_groupowner_at_allow_uid_0:ste:1	oval:ssg-state_file_groupowner_at_allow_gid_0_0:ste:1

Verify Group Who Owns /etc/cron.allow file

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_cron_allow:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.8
pcidss4	2.2.6, 2.2

Description

If /etc/cron.allow exists, it must be group-owned by root. To properly set the group owner of /etc/cron.allow, run the command:

$ sudo chgrp root /etc/cron.allow

Rationale

If the owner of the cron.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.

OVAL test results details

Testing group ownership of /etc/cron.allow oval:ssg-test_file_groupowner_cron_allow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_cron_allow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/cron.allow	oval:ssg-symlink_file_groupowner_cron_allow_uid_0:ste:1	oval:ssg-state_file_groupowner_cron_allow_gid_0_0:ste:1

Verify User Who Owns /etc/cron.allow file

Rule ID xccdf_org.ssgproject.content_rule_file_owner_cron_allow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_cron_allow:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.8
pcidss4	2.2.6, 2.2

Description

If /etc/cron.allow exists, it must be owned by root. To properly set the owner of /etc/cron.allow, run the command:

$ sudo chown root /etc/cron.allow

Rationale

If the owner of the cron.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.

OVAL test results details

Testing user ownership of /etc/cron.allow oval:ssg-test_file_owner_cron_allow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_cron_allow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/cron.allow	oval:ssg-symlink_file_owner_cron_allow_uid_0:ste:1	oval:ssg-state_file_owner_cron_allow_uid_0_0:ste:1

Verify Permissions on /etc/at.allow file

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_at_allow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_at_allow:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis	2.4.2.1
pcidss4	2.2.6, 2.2

Description

If /etc/at.allow exists, it must have permissions 0640 or more restrictive. To properly set the permissions of /etc/at.allow, run the command:

$ sudo chmod 0640 /etc/at.allow

Rationale

If the permissions of the at.allow file are not set to 0640 or more restrictive, the possibility exists for an unauthorized user to view or edit sensitive information.

OVAL test results details

Testing mode of /etc/at.allow oval:ssg-test_file_permissions_at_allow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_at_allow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/at.allow	oval:ssg-exclude_symlinks__at_allow:ste:1	oval:ssg-state_file_permissions_at_allow_0_mode_0640or_stricter_:ste:1

Verify Permissions on /etc/cron.allow file

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_cron_allow

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_cron_allow:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

disa	CCI-000366
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.8
pcidss4	2.2.6, 2.2

Description

If /etc/cron.allow exists, it must have permissions 0640 or more restrictive. To properly set the permissions of /etc/cron.allow, run the command:

$ sudo chmod 0640 /etc/cron.allow

Rationale

If the permissions of the cron.allow file are not set to 0640 or more restrictive, the possibility exists for an unauthorized user to view or edit sensitive information.

OVAL test results details

Testing mode of /etc/cron.allow oval:ssg-test_file_permissions_cron_allow_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_cron_allow_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/cron.allow	oval:ssg-exclude_symlinks__cron_allow:ste:1	oval:ssg-state_file_permissions_cron_allow_0_mode_0640or_stricter_:ste:1

Install the cron service

Rule ID

xccdf_org.ssgproject.content_rule_package_cron_installed

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-package_cron_installed:def:1

Time

2025-06-26T17:28:52+00:00

Severity

medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
disa	CCI-000366
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.1
pcidss4	2.2.6, 2.2

Description

The Cron service should be installed.

Rationale

The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.

OVAL test results details

package cronie is installed oval:ssg-test_package_cronie_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	cronie	x86_64	(none)	13.el9	1.5.7	0:1.5.7-13.el9	d36cb86cb86b3716	cronie-0:1.5.7-13.el9.x86_64

Enable cron Service

Rule ID xccdf_org.ssgproject.content_rule_service_crond_enabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-service_crond_enabled:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	2.4.1.1

Description

The crond service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The crond service can be enabled with the following command:

$ sudo systemctl enable crond.service

Rationale

Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.

OVAL test results details

package cronie is installed oval:ssg-test_service_crond_package_cronie_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	cronie	x86_64	(none)	13.el9	1.5.7	0:1.5.7-13.el9	d36cb86cb86b3716	cronie-0:1.5.7-13.el9.x86_64

Test that the crond service is running oval:ssg-test_service_running_crond:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
true	crond.service	ActiveState	active

systemd test oval:ssg-test_multi_user_wants_crond:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
true	multi-user.target	basic.target	sysinit.target	selinux-autorelabel-mark.service	systemd-sysusers.service	systemd-journal-catalog-update.service	cryptsetup.target	sys-kernel-debug.mount	nis-domainname.service	dev-mqueue.mount	systemd-random-seed.service	systemd-modules-load.service	dracut-shutdown.service	proc-sys-fs-binfmt_misc.automount	sys-kernel-tracing.mount	systemd-sysctl.service	systemd-update-done.service	systemd-pcrphase-sysinit.service	systemd-udevd.service	systemd-tmpfiles-setup.service	systemd-network-generator.service	swap.target	ldconfig.service	systemd-pcrmachine.service	systemd-update-utmp.service	dev-hugepages.mount	systemd-udev-trigger.service	integritysetup.target	sys-kernel-config.mount	systemd-journal-flush.service	kmod-static-nodes.service	systemd-machine-id-commit.service	systemd-journald.service	systemd-repart.service	systemd-binfmt.service	veritysetup.target	systemd-boot-random-seed.service	systemd-boot-update.service	systemd-tmpfiles-setup-dev.service	systemd-ask-password-console.path	systemd-firstboot.service	sys-fs-fuse-connections.mount	local-fs.target	boot-efi.mount	-.mount	boot.mount	systemd-remount-fs.service	systemd-pcrphase.service	systemd-hwdb-update.service	paths.target	microcode.service	slices.target	-.slice	system.slice	sockets.target	rpcbind.socket	dbus.socket	systemd-initctl.socket	systemd-journald-dev-log.socket	systemd-udevd-control.socket	sssd-kcm.socket	systemd-journald.socket	systemd-udevd-kernel.socket	systemd-coredump.socket	timers.target	logrotate.timer	systemd-tmpfiles-clean.timer	dnf-makecache.timer	sssd.service	chronyd.service	nfs-client.target	remote-fs-pre.target	auth-rpcgss-module.service	rpc-statd-notify.service	firewalld.service	NetworkManager.service	cloud-init.target	cloud-init-local.service	cloud-init.service	cloud-config.service	cloud-final.service	tuned.service	getty.target	[email protected]	[email protected]	irqbalance.service	auditd.service	sshd.service	systemd-update-utmp-runlevel.service	systemd-logind.service	rsyslog.service	systemd-user-sessions.service	crond.service	systemd-ask-password-wall.path	droplet-agent.service	remote-fs.target

systemd test oval:ssg-test_multi_user_wants_crond_socket:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
false	multi-user.target	basic.target	sysinit.target	selinux-autorelabel-mark.service	systemd-sysusers.service	systemd-journal-catalog-update.service	cryptsetup.target	sys-kernel-debug.mount	nis-domainname.service	dev-mqueue.mount	systemd-random-seed.service	systemd-modules-load.service	dracut-shutdown.service	proc-sys-fs-binfmt_misc.automount	sys-kernel-tracing.mount	systemd-sysctl.service	systemd-update-done.service	systemd-pcrphase-sysinit.service	systemd-udevd.service	systemd-tmpfiles-setup.service	systemd-network-generator.service	swap.target	ldconfig.service	systemd-pcrmachine.service	systemd-update-utmp.service	dev-hugepages.mount	systemd-udev-trigger.service	integritysetup.target	sys-kernel-config.mount	systemd-journal-flush.service	kmod-static-nodes.service	systemd-machine-id-commit.service	systemd-journald.service	systemd-repart.service	systemd-binfmt.service	veritysetup.target	systemd-boot-random-seed.service	systemd-boot-update.service	systemd-tmpfiles-setup-dev.service	systemd-ask-password-console.path	systemd-firstboot.service	sys-fs-fuse-connections.mount	local-fs.target	boot-efi.mount	-.mount	boot.mount	systemd-remount-fs.service	systemd-pcrphase.service	systemd-hwdb-update.service	paths.target	microcode.service	slices.target	-.slice	system.slice	sockets.target	rpcbind.socket	dbus.socket	systemd-initctl.socket	systemd-journald-dev-log.socket	systemd-udevd-control.socket	sssd-kcm.socket	systemd-journald.socket	systemd-udevd-kernel.socket	systemd-coredump.socket	timers.target	logrotate.timer	systemd-tmpfiles-clean.timer	dnf-makecache.timer	sssd.service	chronyd.service	nfs-client.target	remote-fs-pre.target	auth-rpcgss-module.service	rpc-statd-notify.service	firewalld.service	NetworkManager.service	cloud-init.target	cloud-init-local.service	cloud-init.service	cloud-config.service	cloud-final.service	tuned.service	getty.target	[email protected]	[email protected]	irqbalance.service	auditd.service	sshd.service	systemd-update-utmp-runlevel.service	systemd-logind.service	rsyslog.service	systemd-user-sessions.service	crond.service	systemd-ask-password-wall.path	droplet-agent.service	remote-fs.target

Verify Group Who Owns cron.d

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_cron_d

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_cron_d:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.7
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/cron.d, run the command:

$ sudo chgrp root /etc/cron.d

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

OVAL test results details

Testing group ownership of /etc/cron.d/ oval:ssg-test_file_groupowner_cron_d_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_cron_d_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.d	no value	oval:ssg-symlink_file_groupowner_cron_d_uid_0:ste:1	oval:ssg-state_file_groupowner_cron_d_gid_0_0:ste:1

Verify Group Who Owns cron.daily

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_cron_daily:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.4
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/cron.daily, run the command:

$ sudo chgrp root /etc/cron.daily

Rationale

OVAL test results details

Testing group ownership of /etc/cron.daily/ oval:ssg-test_file_groupowner_cron_daily_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_cron_daily_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.daily	no value	oval:ssg-symlink_file_groupowner_cron_daily_uid_0:ste:1	oval:ssg-state_file_groupowner_cron_daily_gid_0_0:ste:1

Verify Group Who Owns cron.hourly

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_cron_hourly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.3
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/cron.hourly, run the command:

$ sudo chgrp root /etc/cron.hourly

Rationale

OVAL test results details

Testing group ownership of /etc/cron.hourly/ oval:ssg-test_file_groupowner_cron_hourly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_cron_hourly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.hourly	no value	oval:ssg-symlink_file_groupowner_cron_hourly_uid_0:ste:1	oval:ssg-state_file_groupowner_cron_hourly_gid_0_0:ste:1

Verify Group Who Owns cron.monthly

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_cron_monthly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.6
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/cron.monthly, run the command:

$ sudo chgrp root /etc/cron.monthly

Rationale

OVAL test results details

Testing group ownership of /etc/cron.monthly/ oval:ssg-test_file_groupowner_cron_monthly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_cron_monthly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.monthly	no value	oval:ssg-symlink_file_groupowner_cron_monthly_uid_0:ste:1	oval:ssg-state_file_groupowner_cron_monthly_gid_0_0:ste:1

Verify Group Who Owns cron.weekly

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_cron_weekly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.5
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/cron.weekly, run the command:

$ sudo chgrp root /etc/cron.weekly

Rationale

OVAL test results details

Testing group ownership of /etc/cron.weekly/ oval:ssg-test_file_groupowner_cron_weekly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_cron_weekly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.weekly	no value	oval:ssg-symlink_file_groupowner_cron_weekly_uid_0:ste:1	oval:ssg-state_file_groupowner_cron_weekly_gid_0_0:ste:1

Verify Group Who Owns Crontab

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_crontab

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_crontab:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.2
pcidss4	2.2.6, 2.2

Description

To properly set the group owner of /etc/crontab, run the command:

$ sudo chgrp root /etc/crontab

Rationale

OVAL test results details

Testing group ownership of /etc/crontab oval:ssg-test_file_groupowner_crontab_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_crontab_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/crontab	oval:ssg-symlink_file_groupowner_crontab_uid_0:ste:1	oval:ssg-state_file_groupowner_crontab_gid_0_0:ste:1

Verify Owner on cron.d

Rule ID xccdf_org.ssgproject.content_rule_file_owner_cron_d

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_cron_d:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.7
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/cron.d, run the command:

$ sudo chown root /etc/cron.d

Rationale

OVAL test results details

Testing user ownership of /etc/cron.d/ oval:ssg-test_file_owner_cron_d_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_cron_d_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.d	no value	oval:ssg-symlink_file_owner_cron_d_uid_0:ste:1	oval:ssg-state_file_owner_cron_d_uid_0_0:ste:1

Verify Owner on cron.daily

Rule ID xccdf_org.ssgproject.content_rule_file_owner_cron_daily

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_cron_daily:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.4
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/cron.daily, run the command:

$ sudo chown root /etc/cron.daily

Rationale

OVAL test results details

Testing user ownership of /etc/cron.daily/ oval:ssg-test_file_owner_cron_daily_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_cron_daily_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.daily	no value	oval:ssg-symlink_file_owner_cron_daily_uid_0:ste:1	oval:ssg-state_file_owner_cron_daily_uid_0_0:ste:1

Verify Owner on cron.hourly

Rule ID xccdf_org.ssgproject.content_rule_file_owner_cron_hourly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_cron_hourly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.3
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/cron.hourly, run the command:

$ sudo chown root /etc/cron.hourly

Rationale

OVAL test results details

Testing user ownership of /etc/cron.hourly/ oval:ssg-test_file_owner_cron_hourly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_cron_hourly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.hourly	no value	oval:ssg-symlink_file_owner_cron_hourly_uid_0:ste:1	oval:ssg-state_file_owner_cron_hourly_uid_0_0:ste:1

Verify Owner on cron.monthly

Rule ID xccdf_org.ssgproject.content_rule_file_owner_cron_monthly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_cron_monthly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.6
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/cron.monthly, run the command:

$ sudo chown root /etc/cron.monthly

Rationale

OVAL test results details

Testing user ownership of /etc/cron.monthly/ oval:ssg-test_file_owner_cron_monthly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_cron_monthly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.monthly	no value	oval:ssg-symlink_file_owner_cron_monthly_uid_0:ste:1	oval:ssg-state_file_owner_cron_monthly_uid_0_0:ste:1

Verify Owner on cron.weekly

Rule ID xccdf_org.ssgproject.content_rule_file_owner_cron_weekly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_cron_weekly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.5
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/cron.weekly, run the command:

$ sudo chown root /etc/cron.weekly

Rationale

OVAL test results details

Testing user ownership of /etc/cron.weekly/ oval:ssg-test_file_owner_cron_weekly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_cron_weekly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.weekly	no value	oval:ssg-symlink_file_owner_cron_weekly_uid_0:ste:1	oval:ssg-state_file_owner_cron_weekly_uid_0_0:ste:1

Verify Owner on crontab

Rule ID xccdf_org.ssgproject.content_rule_file_owner_crontab

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_crontab:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.2
pcidss4	2.2.6, 2.2

Description

To properly set the owner of /etc/crontab, run the command:

$ sudo chown root /etc/crontab

Rationale

OVAL test results details

Testing user ownership of /etc/crontab oval:ssg-test_file_owner_crontab_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_crontab_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/crontab	oval:ssg-symlink_file_owner_crontab_uid_0:ste:1	oval:ssg-state_file_owner_crontab_uid_0_0:ste:1

Verify Permissions on cron.d

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_cron_d

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_cron_d:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.7
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/cron.d, run the command:

$ sudo chmod 0700 /etc/cron.d

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.

OVAL test results details

Testing mode of /etc/cron.d/ oval:ssg-test_file_permissions_cron_d_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_cron_d_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.d	no value	oval:ssg-exclude_symlinks__cron_d:ste:1	oval:ssg-state_file_permissions_cron_d_0_mode_0700or_stricter_:ste:1

Verify Permissions on cron.daily

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_cron_daily

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_cron_daily:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.4
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/cron.daily, run the command:

$ sudo chmod 0700 /etc/cron.daily

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.

OVAL test results details

Testing mode of /etc/cron.daily/ oval:ssg-test_file_permissions_cron_daily_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_cron_daily_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.daily	no value	oval:ssg-exclude_symlinks__cron_daily:ste:1	oval:ssg-state_file_permissions_cron_daily_0_mode_0700or_stricter_:ste:1

Verify Permissions on cron.hourly

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_cron_hourly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.3
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/cron.hourly, run the command:

$ sudo chmod 0700 /etc/cron.hourly

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.

OVAL test results details

Testing mode of /etc/cron.hourly/ oval:ssg-test_file_permissions_cron_hourly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_cron_hourly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.hourly	no value	oval:ssg-exclude_symlinks__cron_hourly:ste:1	oval:ssg-state_file_permissions_cron_hourly_0_mode_0700or_stricter_:ste:1

Verify Permissions on cron.monthly

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_cron_monthly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.6
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/cron.monthly, run the command:

$ sudo chmod 0700 /etc/cron.monthly

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.

OVAL test results details

Testing mode of /etc/cron.monthly/ oval:ssg-test_file_permissions_cron_monthly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_cron_monthly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.monthly	no value	oval:ssg-exclude_symlinks__cron_monthly:ste:1	oval:ssg-state_file_permissions_cron_monthly_0_mode_0700or_stricter_:ste:1

Verify Permissions on cron.weekly

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_cron_weekly:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.5
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/cron.weekly, run the command:

$ sudo chmod 0700 /etc/cron.weekly

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.

OVAL test results details

Testing mode of /etc/cron.weekly/ oval:ssg-test_file_permissions_cron_weekly_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_cron_weekly_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/cron.weekly	no value	oval:ssg-exclude_symlinks__cron_weekly:ste:1	oval:ssg-state_file_permissions_cron_weekly_0_mode_0700or_stricter_:ste:1

Verify Permissions on crontab

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_crontab

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_crontab:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
cis	2.4.1.2
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/crontab, run the command:

$ sudo chmod 0600 /etc/crontab

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.

OVAL test results details

Testing mode of /etc/crontab oval:ssg-test_file_permissions_crontab_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_crontab_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/crontab	oval:ssg-exclude_symlinks__crontab:ste:1	oval:ssg-state_file_permissions_crontab_0_mode_0600or_stricter_:ste:1

Uninstall DHCP Server Package

Rule ID xccdf_org.ssgproject.content_rule_package_dhcp_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_dhcp_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
anssi	R62
cis	2.1.3
pcidss4	2.2.4, 2.2

Description

If the system does not need to act as a DHCP server, the dhcp package can be uninstalled. The dhcp package can be removed with the following command:

$ sudo dnf remove dhcp

Rationale

Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.

OVAL test results details

package dhcp is removed oval:ssg-test_package_dhcp_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_dhcp_removed:obj:1 of type rpminfo_object

Name
dhcp

Uninstall bind Package

Rule ID xccdf_org.ssgproject.content_rule_package_bind_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_bind_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity low

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	2.1.4

Description

The named service is provided by the bind package. The bind package can be removed with the following command:

$ sudo dnf remove bind

Rationale

If there is no need to make DNS server software available, removing it provides a safeguard against its activation.

OVAL test results details

package bind is removed oval:ssg-test_package_bind_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_bind_removed:obj:1 of type rpminfo_object

Name
bind

Uninstall dnsmasq Package

Rule ID xccdf_org.ssgproject.content_rule_package_dnsmasq_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_dnsmasq_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity low

References:

cis	2.1.5

Description

dnsmasq is a lightweight tool that provides DNS caching, DNS forwarding and DHCP (Dynamic Host Configuration Protocol) services.
The dnsmasq package can be removed with the following command:

$ sudo dnf remove dnsmasq

Rationale

Unless a system is specifically designated to act as a DNS caching, DNS forwarding and/or DHCP server, it is recommended that the package be removed to reduce the potential attack surface.

OVAL test results details

package dnsmasq is removed oval:ssg-test_package_dnsmasq_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_dnsmasq_removed:obj:1 of type rpminfo_object

Name
dnsmasq

Uninstall vsftpd Package

Rule ID xccdf_org.ssgproject.content_rule_package_vsftpd_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_vsftpd_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity high

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
disa	CCI-000366, CCI-000197, CCI-000381
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a), IA-5(1)(c), IA-5(1).1(v), CM-7, CM-7.1(ii)
nist-csf	PR.IP-1, PR.PT-3
os-srg	SRG-OS-000074-GPOS-00042, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227
cis	2.1.7

Description

The vsftpd package can be removed with the following command:

 $ sudo dnf remove vsftpd

Rationale

Removing the vsftpd package decreases the risk of its accidental activation.

OVAL test results details

package vsftpd is removed oval:ssg-test_package_vsftpd_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_vsftpd_removed:obj:1 of type rpminfo_object

Name
vsftpd

Remove ftp Package

Rule ID xccdf_org.ssgproject.content_rule_package_ftp_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_ftp_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity low

References:

cis	2.2.1
pcidss4	2.2.4, 2.2

Description

FTP (File Transfer Protocol) is a traditional and widely used standard tool for transferring files between a server and clients over a network, especially where no authentication is necessary (permits anonymous users to connect to a server).
The ftp package can be removed with the following command:

$ sudo dnf remove ftp

Rationale

FTP does not protect the confidentiality of data or authentication credentials. It is recommended SFTP be used if file transfer is required. Unless there is a need to run the system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be removed to reduce the potential attack surface.

OVAL test results details

package ftp is removed oval:ssg-test_package_ftp_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_ftp_removed:obj:1 of type rpminfo_object

Name
ftp

Uninstall httpd Package

Rule ID xccdf_org.ssgproject.content_rule_package_httpd_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_httpd_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity unknown

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	2.1.18

Description

The httpd package can be removed with the following command:

$ sudo dnf remove httpd

Rationale

If there is no need to make the web server software available, removing it provides a safeguard against its activation.

OVAL test results details

package httpd is removed oval:ssg-test_package_httpd_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_httpd_removed:obj:1 of type rpminfo_object

Name
httpd

Uninstall nginx Package

Rule ID xccdf_org.ssgproject.content_rule_package_nginx_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_nginx_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity unknown

References:

cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	2.1.18

Description

The nginx package can be removed with the following command:

$ sudo dnf remove nginx

Rationale

If there is no need to make the web server software available, removing it provides a safeguard against its activation.

OVAL test results details

package nginx is removed oval:ssg-test_package_nginx_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_nginx_removed:obj:1 of type rpminfo_object

Name
nginx

Uninstall cyrus-imapd Package

Rule ID xccdf_org.ssgproject.content_rule_package_cyrus-imapd_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_cyrus-imapd_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity unknown

References:

cis	2.1.8

Description

The cyrus-imapd package can be removed with the following command:

$ sudo dnf remove cyrus-imapd

Rationale

If there is no need to make the cyrus-imapd software available, removing it provides a safeguard against its activation.

OVAL test results details

package cyrus-imapd is removed oval:ssg-test_package_cyrus-imapd_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_cyrus-imapd_removed:obj:1 of type rpminfo_object

Name
cyrus-imapd

Uninstall dovecot Package

Rule ID xccdf_org.ssgproject.content_rule_package_dovecot_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_dovecot_removed:def:1

Time 2025-06-26T17:28:54+00:00

Severity unknown

References:

cis	2.1.8

Description

The dovecot package can be removed with the following command:

$ sudo dnf remove dovecot

Rationale

If there is no need to make the Dovecot software available, removing it provides a safeguard against its activation.

OVAL test results details

package dovecot is removed oval:ssg-test_package_dovecot_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_dovecot_removed:obj:1 of type rpminfo_object

Name
dovecot

Disable Postfix Network Listening

Rule ID xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:54+00:00

Severity medium

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
disa	CCI-000382
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
anssi	R74
cis	2.1.21
pcidss4	1.4.2, 1.4

Description

Edit the file /etc/postfix/main.cf to ensure that only the following inet_interfaces line appears:

inet_interfaces = loopback-only

Rationale

This ensures postfix accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack.

Ensure Mail Transfer Agent is not Listening on any non-loopback Address

Rule ID

xccdf_org.ssgproject.content_rule_has_nonlocal_mta

Result

pass

Multi-check rule

OVAL Definition ID

oval:ssg-has_nonlocal_mta:def:1

Time

2025-06-26T17:28:54+00:00

Severity

medium

References:

cis	2.1.21

Description

Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail.

Rationale

The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems.

OVAL test results details

mta is not listening on any non-loopback address 25 oval:ssg-tst_nothing_listening_external_mta_port_25:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_listening_port_25:obj:1 of type inetlisteningservers_object

Protocol	Local address	Local port	Filter	Filter
tcp	127.0.0.1	25	oval:ssg-ste_not_port_25:ste:1	oval:ssg-ste_not_on_localhost:ste:1

Disable rpcbind Service

Rule ID xccdf_org.ssgproject.content_rule_service_rpcbind_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-service_rpcbind_disabled:def:1

Time 2025-06-26T17:28:55+00:00

Severity low

References:

cis	2.1.12
pcidss4	2.2.4, 2.2

Description

The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The rpcbind service redirects the client to the proper port number so it can communicate with the requested service. If the system does not require RPC (such as for NFS servers) then this service should be disabled. The rpcbind service can be disabled with the following command:

$ sudo systemctl mask --now rpcbind.service

Rationale

If the system does not require rpc based services, it is recommended that rpcbind be disabled to reduce the attack surface.

OVAL test results details

package rpcbind is removed oval:ssg-service_rpcbind_disabled_test_service_rpcbind_package_rpcbind_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	rpcbind	x86_64	(none)	7.el9	1.2.6	0:1.2.6-7.el9	d36cb86cb86b3716	rpcbind-0:1.2.6-7.el9.x86_64

Test that the rpcbind service is not running oval:ssg-test_service_not_running_service_rpcbind_disabled_rpcbind:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
true	rpcbind.socket	ActiveState	inactive
true	rpcbind.service	ActiveState	inactive

Test that the property LoadState from the service rpcbind is masked oval:ssg-test_service_loadstate_is_masked_service_rpcbind_disabled_rpcbind:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
true	rpcbind.service	LoadState	masked
true	rpcbind.socket	LoadState	masked

Disable Network File System (nfs)

Rule ID xccdf_org.ssgproject.content_rule_service_nfs_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-service_nfs_disabled:def:1

Time 2025-06-26T17:28:57+00:00

Severity unknown

References:

cis-csc	11, 12, 14, 15, 16, 18, 3, 5
cobit5	DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7
iso27001-2013	A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-4, PR.AC-6, PR.PT-3
cis	2.1.9

Description

The Network File System (NFS) service allows remote hosts to mount and interact with shared filesystems on the local system. If the local system is not designated as a NFS server then this service should be disabled. The nfs-server service can be disabled with the following command:

$ sudo systemctl mask --now nfs-server.service

Rationale

Unnecessary services should be disabled to decrease the attack surface of the system.

OVAL test results details

package nfs-utils is removed oval:ssg-service_nfs_disabled_test_service_nfs-server_package_nfs-utils_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	nfs-utils	x86_64	1	34.el9	2.5.4	1:2.5.4-34.el9	d36cb86cb86b3716	nfs-utils-1:2.5.4-34.el9.x86_64

Test that the nfs-server service is not running oval:ssg-test_service_not_running_service_nfs_disabled_nfs-server:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
true	nfs-server.service	ActiveState	inactive

Test that the property LoadState from the service nfs-server is masked oval:ssg-test_service_loadstate_is_masked_service_nfs_disabled_nfs-server:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Unit	Property	Value
true	nfs-server.service	LoadState	masked

The Chrony package is installed

Rule ID xccdf_org.ssgproject.content_rule_package_chrony_installed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_chrony_installed:def:1

Time 2025-06-26T17:28:57+00:00

Severity medium

References:

disa	CCI-004923
ism	0988, 1405
ospp	FMT_SMF_EXT.1
pcidss	Req-10.4
os-srg	SRG-OS-000355-GPOS-00143
anssi	R71
cis	2.3.1
pcidss4	10.6.1, 10.6

Description

System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them. The chrony package can be installed with the following command:

$ sudo dnf install chrony

Rationale

Time synchronization is important to support time sensitive security mechanisms like Kerberos and also ensures log files have consistent time records across the enterprise, which aids in forensic investigations.

OVAL test results details

package chrony is installed oval:ssg-test_package_chrony_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	chrony	x86_64	(none)	1.el9	4.6.1	0:4.6.1-1.el9	d36cb86cb86b3716	chrony-0:4.6.1-1.el9.x86_64

A remote time server for Chrony is configured

Rule ID xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-chronyd_specify_remote_server:def:1

Time 2025-06-26T17:28:57+00:00

Severity medium

References:

disa	CCI-001890, CCI-004926, CCI-004923
ism	0988, 1405
nist	CM-6(a), AU-8(1)(a)
pcidss	Req-10.4.3
os-srg	SRG-OS-000355-GPOS-00143
anssi	R71
cis	2.3.2
pcidss4	10.6.2, 10.6

Description

Chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at https://chrony-project.org/. Chrony can be configured to be a client and/or a server. Add or edit server or pool lines to /etc/chrony.conf as appropriate:

server <remote-server>

Multiple servers may be configured.

Rationale

If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.

OVAL test results details

Ensure at least one NTP server is set oval:ssg-test_chronyd_remote_server:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/chrony.conf	pool 2.almalinux.pool.ntp.org iburst

Ensure that chronyd is running under chrony user account

Rule ID xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-chronyd_run_as_chrony_user:def:1

Time 2025-06-26T17:28:57+00:00

Severity medium

References:

cis	2.3.3
pcidss4	10.6.3, 10.6

Description

chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at https://chrony-project.org/. Chrony can be configured to be a client and/or a server. To ensure that chronyd is running under chrony user account, add or edit the OPTIONS variable in /etc/sysconfig/chronyd to include -u chrony:

OPTIONS="-u chrony"

This recommendation only applies if chrony is in use on the system.

Rationale

If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.

OVAL test results details

tests the value of OPTIONS setting in the /etc/sysconfig/chronyd file oval:ssg-test_chronyd_run_as_chrony_user:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/sysconfig/chronyd	OPTIONS="-F 2 -u chrony"

The configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Type	UID	GID	Size (B)	Permissions
not evaluated	/etc/sysconfig/chronyd	regular	0	0	60	`rw-r--r--`

Uninstall xinetd Package

Rule ID xccdf_org.ssgproject.content_rule_package_xinetd_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_xinetd_removed:def:1

Time 2025-06-26T17:28:57+00:00

Severity low

References:

cis-csc	11, 12, 14, 15, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06
disa	CCI-000305
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4
anssi	R62
cis	2.1.19
pcidss4	2.2.4, 2.2

Description

The xinetd package can be removed with the following command:

$ sudo dnf remove xinetd

Rationale

Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.

Warnings

warning The package is not available in AlmaLinux OS 9.

OVAL test results details

package xinetd is removed oval:ssg-test_package_xinetd_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_xinetd_removed:obj:1 of type rpminfo_object

Name
xinetd

Remove NIS Client

Rule ID xccdf_org.ssgproject.content_rule_package_ypbind_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_ypbind_removed:def:1

Time 2025-06-26T17:28:57+00:00

Severity unknown

References:

hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
anssi	R62
cis	2.2.3
pcidss4	2.2.4, 2.2

Description

The Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client (ypbind) was used to bind a system to an NIS server and receive the distributed configuration files.

Rationale

The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be removed.

Warnings

warning The package is not available in AlmaLinux OS 9.

OVAL test results details

package ypbind is removed oval:ssg-test_package_ypbind_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_ypbind_removed:obj:1 of type rpminfo_object

Name
ypbind

Uninstall ypserv Package

Rule ID xccdf_org.ssgproject.content_rule_package_ypserv_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_ypserv_removed:def:1

Time 2025-06-26T17:28:57+00:00

Severity high

References:

cis-csc	11, 12, 14, 15, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06
disa	CCI-000381
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a), IA-5(1)(c)
nist-csf	PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4
pcidss	Req-2.2.2
os-srg	SRG-OS-000095-GPOS-00049
anssi	R62
cis	2.1.10
pcidss4	2.2.4, 2.2

Description

The ypserv package can be removed with the following command:

$ sudo dnf remove ypserv

Rationale

The NIS service provides an unencrypted authentication service which does not provide for the confidentiality and integrity of user passwords or the remote session. Removing the ypserv package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.

Warnings

warning The package is not available in AlmaLinux OS 9.

OVAL test results details

package ypserv is removed oval:ssg-test_package_ypserv_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_ypserv_removed:obj:1 of type rpminfo_object

Name
ypserv

Remove Rsh Trust Files

Rule ID xccdf_org.ssgproject.content_rule_no_rsh_trust_files

Result

notapplicable

Multi-check rule no

Time 2025-06-26T17:28:57+00:00

Severity high

References:

cis-csc	11, 12, 14, 15, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06
disa	CCI-001436
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4
cis	7.2.9

Description

The files /etc/hosts.equiv and ~/.rhosts (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location:

$ sudo rm /etc/hosts.equiv

$ rm ~/.rhosts

Rationale

This action is only meaningful if .rhosts support is permitted through PAM. Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system.

Uninstall telnet-server Package

Rule ID xccdf_org.ssgproject.content_rule_package_telnet-server_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_telnet-server_removed:def:1

Time 2025-06-26T17:28:57+00:00

Severity high

References:

cis-csc	11, 12, 14, 15, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06
disa	CCI-000381
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4
pcidss	Req-2.2.2
os-srg	SRG-OS-000095-GPOS-00049
anssi	R62
cis	2.1.15
pcidss4	2.2.4, 2.2

Description

The telnet-server package can be removed with the following command:

$ sudo dnf remove telnet-server

Rationale

It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities are often overlooked and therefore may remain unsecure. They increase the risk to the platform by providing additional attack vectors.
The telnet service provides an unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using this service, the privileged user password could be compromised.
Removing the telnet-server package decreases the risk of the telnet service's accidental (or intentional) activation.

OVAL test results details

package telnet-server is removed oval:ssg-test_package_telnet-server_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_telnet-server_removed:obj:1 of type rpminfo_object

Name
telnet-server

Remove telnet Clients

Rule ID xccdf_org.ssgproject.content_rule_package_telnet_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_telnet_removed:def:1

Time 2025-06-26T17:28:57+00:00

Severity low

References:

cui	3.1.13
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
iso27001-2013	A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3
anssi	R62
cis	2.2.4
pcidss4	2.2.4, 2.2

Description

The telnet client allows users to start connections to other systems via the telnet protocol.

Rationale

The telnet protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an unauthorized user to steal credentials. The ssh package provides an encrypted session and stronger security and is included in AlmaLinux OS 9.

OVAL test results details

package telnet is removed oval:ssg-test_package_telnet_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_telnet_removed:obj:1 of type rpminfo_object

Name
telnet

Uninstall tftp-server Package

Rule ID xccdf_org.ssgproject.content_rule_package_tftp-server_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_tftp-server_removed:def:1

Time 2025-06-26T17:28:57+00:00

Severity high

References:

cis-csc	11, 12, 14, 15, 3, 8, 9
cobit5	APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06
disa	CCI-000366
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6
iso27001-2013	A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R62
cis	2.1.16
pcidss4	2.2.4, 2.2

Description

The tftp-server package can be removed with the following command:

 $ sudo dnf remove tftp-server

Rationale

Removing the tftp-server package decreases the risk of the accidental (or intentional) activation of tftp services.

If TFTP is required for operational support (such as transmission of router configurations), its use must be documented with the Information Systems Securty Manager (ISSM), restricted to only authorized personnel, and have access control rules established.

OVAL test results details

package tftp-server is removed oval:ssg-test_package_tftp-server_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_tftp-server_removed:obj:1 of type rpminfo_object

Name
tftp-server

Remove tftp Daemon

Rule ID xccdf_org.ssgproject.content_rule_package_tftp_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_tftp_removed:def:1

Time 2025-06-26T17:28:57+00:00

Severity low

References:

disa	CCI-000197
os-srg	SRG-OS-000074-GPOS-00042
anssi	R62
cis	2.2.5
pcidss4	2.2.4, 2.2

Description

Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot files between systems. TFTP does not support authentication and can be easily hacked. The package tftp is a client program that allows for connections to a tftp server.

Rationale

It is recommended that TFTP be removed, unless there is a specific need for TFTP (such as a boot server). In that case, use extreme caution when configuring the services.

OVAL test results details

package tftp is removed oval:ssg-test_package_tftp_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_tftp_removed:obj:1 of type rpminfo_object

Name
tftp

Uninstall rsync Package

Rule ID xccdf_org.ssgproject.content_rule_package_rsync_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_rsync_removed:def:1

Time 2025-06-26T17:28:57+00:00

Severity medium

References:

cis	2.1.13

Description

The rsyncd service can be used to synchronize files between systems over network links. The rsync package can be removed with the following command:

$ sudo dnf remove rsync

Rationale

The rsyncd service presents a security risk as it uses unencrypted protocols for communication.

OVAL test results details

package rsync is removed oval:ssg-test_package_rsync_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_rsync_removed:obj:1 of type rpminfo_object

Name
rsync

Disable the CUPS Service

Rule ID xccdf_org.ssgproject.content_rule_service_cups_disabled

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-service_cups_disabled:def:1

Time 2025-06-26T17:28:58+00:00

Severity unknown

References:

cis-csc	11, 14, 3, 9
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06
isa-62443-2009	4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2
nist	CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1, PR.PT-3
cis	2.1.11

Description

The cups service can be disabled with the following command:

$ sudo systemctl mask --now cups.service

Rationale

Turn off unneeded services to reduce attack surface.

OVAL test results details

package cups is removed oval:ssg-service_cups_disabled_test_service_cups_package_cups_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_cups_disabled_test_service_cups_package_cups_removed:obj:1 of type rpminfo_object

Name
cups

Test that the cups service is not running oval:ssg-test_service_not_running_service_cups_disabled_cups:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_not_running_service_cups_disabled_cups:obj:1 of type systemdunitproperty_object

Unit	Property
^cups\.(service\|socket)$	ActiveState

Test that the property LoadState from the service cups is masked oval:ssg-test_service_loadstate_is_masked_service_cups_disabled_cups:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_loadstate_is_masked_service_cups_disabled_cups:obj:1 of type systemdunitproperty_object

Unit	Property
^cups\.(service\|socket)$	LoadState

Uninstall squid Package

Rule ID xccdf_org.ssgproject.content_rule_package_squid_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_squid_removed:def:1

Time 2025-06-26T17:28:58+00:00

Severity unknown

References:

cis	2.1.17

Description

The squid package can be removed with the following command:

 $ sudo dnf remove squid

Rationale

If there is no need to make the proxy server software available, removing it provides a safeguard against its activation.

OVAL test results details

package squid is removed oval:ssg-test_package_squid_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_squid_removed:obj:1 of type rpminfo_object

Name
squid

Uninstall Samba Package

Rule ID xccdf_org.ssgproject.content_rule_package_samba_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_samba_removed:def:1

Time 2025-06-26T17:28:58+00:00

Severity unknown

References:

cis	2.1.6

Description

The samba package can be removed with the following command:

 $ sudo dnf remove samba

Rationale

If there is no need to make the Samba software available, removing it provides a safeguard against its activation.

OVAL test results details

package samba is removed oval:ssg-test_package_samba_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_samba_removed:obj:1 of type rpminfo_object

Name
samba

Uninstall net-snmp Package

Rule ID xccdf_org.ssgproject.content_rule_package_net-snmp_removed

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-package_net-snmp_removed:def:1

Time 2025-06-26T17:28:58+00:00

Severity unknown

References:

cis	2.1.14
pcidss4	2.2.4, 2.2

Description

The net-snmp package provides the snmpd service. The net-snmp package can be removed with the following command:

$ sudo dnf remove net-snmp

Rationale

If there is no need to run SNMP server software, removing the package provides a safeguard against its activation.

OVAL test results details

package net-snmp is removed oval:ssg-test_package_net-snmp_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_net-snmp_removed:obj:1 of type rpminfo_object

Name
net-snmp

Set SSH Client Alive Count Max

Rule ID xccdf_org.ssgproject.content_rule_sshd_set_keepalive

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_set_keepalive:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8
cjis	5.5.6
cobit5	APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.1.11
disa	CCI-001133, CCI-002361
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2
iso27001-2013	A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nerc-cip	CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a)
nist-csf	DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2
pcidss	Req-8.1.8
os-srg	SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109
cis	5.1.9
pcidss4	8.2.8, 8.2

Description

The SSH server sends at most ClientAliveCountMax messages during a SSH session and waits for a response from the SSH client. The option ClientAliveInterval configures timeout after each ClientAliveCountMax message. If the SSH server does not receive a response from the client, then the connection is considered unresponsive and terminated. For SSH earlier than v8.2, a ClientAliveCountMax value of 0 causes a timeout precisely when the ClientAliveInterval is set. Starting with v8.2, a value of 0 disables the timeout functionality completely. If the option is set to a number greater than 0, then the session will be disconnected after ClientAliveInterval * ClientAliveCountMax seconds without receiving a keep alive message.

Rationale

This ensures a user login will be terminated as soon as the ClientAliveInterval is reached.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_set_keepalive:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_set_keepalive:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_set_keepalive_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	ClientAliveCountMax 1

Verify that the value of ClientAliveCountMax is present oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	ClientAliveCountMax 1

Set SSH Client Alive Interval

Rule ID xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_set_idle_timeout:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8
cjis	5.5.6
cobit5	APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10
cui	3.1.11
disa	CCI-001133, CCI-002361, CCI-002891
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2
iso27001-2013	A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nerc-cip	CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	CM-6(a), AC-17(a), AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a)
nist-csf	DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2
pcidss	Req-8.1.8
os-srg	SRG-OS-000126-GPOS-00066, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000395-GPOS-00175
cis	5.1.9
pcidss4	8.2.8, 8.2

Description

SSH allows administrators to set a network responsiveness timeout interval. After this interval has passed, the unresponsive client will be automatically logged out.

To set this timeout interval, edit the following line in /etc/ssh/sshd_config as follows:

ClientAliveInterval 300

The timeout interval is given in seconds. For example, have a timeout of 10 minutes, set interval to 600.

If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.

Rationale

Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.

Warnings

warning SSH disconnecting unresponsive clients will not have desired effect without also configuring ClientAliveCountMax in the SSH service configuration.

warning Following conditions may prevent the SSH session to time out:

Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.
Any scp or sftp activity by the same user to the host resets the timeout.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

timeout is configured oval:ssg-test_sshd_idle_timeout:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sshd_idle_timeout:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[\s](?i)ClientAliveInterval[\s]+(\d+)[\s](?:#.*)?$	1

timeout is configured in config directory oval:ssg-test_sshd_idle_timeout_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	ClientAliveInterval 300

Verify that the value of ClientAliveInterval is present oval:ssg-test_clientaliveinterval_present:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	ClientAliveInterval 300

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_set_keepalive:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_set_keepalive:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_set_keepalive_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	ClientAliveCountMax 1

Verify that the value of ClientAliveCountMax is present oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	ClientAliveCountMax 1

Disable Host-Based Authentication

Rule ID xccdf_org.ssgproject.content_rule_disable_host_auth

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-disable_host_auth:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	11, 12, 14, 15, 16, 18, 3, 5, 9
cjis	5.5.6
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06
cui	3.1.12
disa	CCI-000366
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
ism	0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	AC-3, AC-17(a), CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-4, PR.AC-6, PR.IP-1, PR.PT-3
ospp	FIA_UAU.1
os-srg	SRG-OS-000480-GPOS-00229
cis	5.1.12
pcidss4	8.3.1, 8.3

Description

SSH's cryptographic host-based authentication is more secure than .rhosts authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization.
The default SSH configuration disables host-based authentication. The appropriate configuration is used if no value is set for HostbasedAuthentication.
To explicitly disable host-based authentication, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:

HostbasedAuthentication no

Rationale

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file oval:ssg-test_disable_host_auth:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_disable_host_auth:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config.d file oval:ssg-test_disable_host_auth_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf	HostbasedAuthentication no

Verify that the value of HostbasedAuthentication is present oval:ssg-test_HostbasedAuthentication_present_disable_host_auth:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf	HostbasedAuthentication no

Disable SSH Access via Empty Passwords

Rule ID xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_disable_empty_passwords:def:1

Time 2025-06-26T17:28:58+00:00

Severity high

References:

cis-csc	11, 12, 13, 14, 15, 16, 18, 3, 5, 9
cjis	5.5.6
cobit5	APO01.06, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06
cui	3.1.1, 3.1.5
disa	CCI-000766, CCI-000366
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	AC-17(a), CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-3
ospp	FIA_UAU.1
pcidss	Req-2.2.4
os-srg	SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229, SRG-OS-000480-GPOS-00227
cis	5.1.19
pcidss4	2.2.6, 2.2

Description

Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for PermitEmptyPasswords.
To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:

PermitEmptyPasswords no

Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.

Rationale

Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_empty_passwords:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_disable_empty_passwords:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf	PermitEmptyPasswords no

Verify that the value of PermitEmptyPasswords is present oval:ssg-test_PermitEmptyPasswords_present_sshd_disable_empty_passwords:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf	PermitEmptyPasswords no

Disable SSH Support for .rhosts Files

Rule ID xccdf_org.ssgproject.content_rule_sshd_disable_rhosts

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_disable_rhosts:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	11, 12, 14, 15, 16, 18, 3, 5, 9
cjis	5.5.6
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06
cui	3.1.12
disa	CCI-000366
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nist	AC-17(a), CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-4, PR.AC-6, PR.IP-1, PR.PT-3
os-srg	SRG-OS-000480-GPOS-00227
cis	5.1.13
pcidss4	2.2.6, 2.2

Description

SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via .rhosts files.
The default SSH configuration disables support for .rhosts. The appropriate configuration is used if no value is set for IgnoreRhosts.
To explicitly disable support for .rhosts files, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:

IgnoreRhosts yes

Rationale

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_rhosts:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_disable_rhosts:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf	IgnoreRhosts yes

Verify that the value of IgnoreRhosts is present oval:ssg-test_IgnoreRhosts_present_sshd_disable_rhosts:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf	IgnoreRhosts yes

Disable SSH Root Login

Rule ID xccdf_org.ssgproject.content_rule_sshd_disable_root_login

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_disable_root_login:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	1, 11, 12, 13, 14, 15, 16, 18, 3, 5
cjis	5.5.6
cobit5	APO01.06, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.06, DSS06.10
cui	3.1.1, 3.1.5
disa	CCI-000366, CCI-004045
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	AC-6(2), AC-17(a), IA-2, IA-2(5), CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, PR.PT-3
ospp	FAU_GEN.1
pcidss	Req-2.2.4
os-srg	SRG-OS-000109-GPOS-00056, SRG-OS-000480-GPOS-00227
app-srg-ctr	SRG-APP-000148-CTR-000335, SRG-APP-000190-CTR-000500
anssi	R33
cis	5.1.20
pcidss4	2.2.6, 2.2

Description

The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:

PermitRootLogin no

Rationale

Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_root_login:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_disable_root_login:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_disable_root_login_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	PermitRootLogin no

Verify that the value of PermitRootLogin is present oval:ssg-test_PermitRootLogin_present_sshd_disable_root_login:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	PermitRootLogin no

Do Not Allow SSH Environment Options

Rule ID xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_do_not_permit_user_env:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	11, 3, 9
cjis	5.5.6
cobit5	BAI10.01, BAI10.02, BAI10.03, BAI10.05
cui	3.1.12
disa	CCI-000366
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.4.3.2, 4.3.4.3.3
isa-62443-2013	SR 7.6
iso27001-2013	A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4
nist	AC-17(a), CM-7(a), CM-7(b), CM-6(a)
nist-csf	PR.IP-1
pcidss	Req-2.2.4
os-srg	SRG-OS-000480-GPOS-00229
cis	5.1.21
pcidss4	2.2.6, 2.2

Description

Ensure that users are not able to override environment variables of the SSH daemon.
The default SSH configuration disables environment processing. The appropriate configuration is used if no value is set for PermitUserEnvironment.
To explicitly disable Environment options, add or correct the following /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:

PermitUserEnvironment no

Rationale

SSH environment options potentially allow users to bypass access restriction in some configurations.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_do_not_permit_user_env:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_do_not_permit_user_env:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf	PermitUserEnvironment no

Verify that the value of PermitUserEnvironment is present oval:ssg-test_PermitUserEnvironment_present_sshd_do_not_permit_user_env:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf	PermitUserEnvironment no

Enable PAM

Rule ID xccdf_org.ssgproject.content_rule_sshd_enable_pam

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_enable_pam:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

disa	CCI-000877
os-srg	SRG-OS-000125-GPOS-00065
cis	5.1.22
pcidss4	2.2.6, 2.2

Description

UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types. To enable PAM authentication, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:

UsePAM yes

Rationale

When UsePAM is set to yes, PAM runs through account and session types properly. This is important if you want to restrict access to services based off of IP, time or other factors of the account. Additionally, you can make sure users inherit certain environment variables on login or disallow access to the server.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of UsePAM setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_enable_pam:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_enable_pam:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)UsePAM(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of UsePAM setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_enable_pam_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/50-redhat.conf	UsePAM yes

Verify that the value of UsePAM is present oval:ssg-test_UsePAM_present_sshd_enable_pam:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/50-redhat.conf	UsePAM yes

Enable SSH Warning Banner

Rule ID xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_enable_warning_banner_net:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cjis	5.5.6
cobit5	DSS05.04, DSS05.10, DSS06.10
cui	3.1.9
disa	CCI-000048, CCI-000050, CCI-001384, CCI-001385, CCI-001386, CCI-001387, CCI-001388
hipaa	164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)
isa-62443-2009	4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9
isa-62443-2013	SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9
iso27001-2013	A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3
nist	AC-8(a), AC-8(c), AC-17(a), CM-6(a)
nist-csf	PR.AC-7
os-srg	SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
cis	5.1.8

Description

To enable the warning banner and ensure it is consistent across the system, add or correct the following line in /etc/ssh/sshd_config:

Banner /etc/issue.net

Another section contains information on how to create an appropriate system-wide warning banner.

Rationale

The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of Banner setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_enable_warning_banner_net:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_enable_warning_banner_net:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)Banner(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of Banner setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_enable_warning_banner_net_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	Banner /etc/issue.net

Verify that the value of Banner is present oval:ssg-test_Banner_present_sshd_enable_warning_banner_net:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	Banner /etc/issue.net

Limit Users' SSH Access

Rule ID

xccdf_org.ssgproject.content_rule_sshd_limit_user_access

Result

fail

Multi-check rule

OVAL Definition ID

oval:ssg-sshd_limit_user_access:def:1

Time

2025-06-26T17:28:58+00:00

Severity

unknown

References:

cis-csc	11, 12, 14, 15, 16, 18, 3, 5
cobit5	DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06
cui	3.1.12
isa-62443-2009	4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4
isa-62443-2013	SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7
iso27001-2013	A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3
nist	AC-3, CM-6(a)
nist-csf	PR.AC-4, PR.AC-6, PR.PT-3
pcidss	Req-2.2.4
cis	5.1.7
pcidss4	2.2.6, 2.2

Description

By default, the SSH configuration allows any user with an account to access the system. There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged: - AllowUsers variable gives the system administrator the option of allowing specific users to ssh into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically allowing a user's access only from a particular host, the entry can be specified in the form of user@host. - AllowGroups variable gives the system administrator the option of allowing specific groups of users to ssh into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable. - DenyUsers variable gives the system administrator the option of denying specific users to ssh into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically denying a user's access from a particular host, the entry can be specified in the form of user@host. - DenyGroups variable gives the system administrator the option of denying specific groups of users to ssh into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable.

Rationale

Specifying which accounts are allowed SSH access into the system reduces the possibility of unauthorized access to the system.

Warnings

warning Automated remediation is not available for this configuration check because each system has unique user names and group names.

OVAL test results details

Check if there is an AllowUsers entry oval:ssg-test_allow_user_is_configured:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_allow_user:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\/etc\/ssh\/sshd_config.*$	(?i)^[ ]AllowUsers[ ]+((?:[^ \n]+[ ])+)$	1

Check if there is an AllowGroups entry oval:ssg-test_allow_group_is_configured:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_allow_group:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^/etc/ssh/sshd_config.*$	(?i)^[ ]AllowGroups[ ]+((?:[^ \n]+[ ])+)$	1

Check if there is a DenyUsers entry oval:ssg-test_deny_user_is_configured:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_deny_user:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^/etc/ssh/sshd_config.*$	(?i)^[ ]DenyUsers[ ]+((?:[^ \n]+[ ])+)$	1

Check if there is a DenyGroups entry oval:ssg-test_deny_group_is_configured:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_deny_group:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^/etc/ssh/sshd_config.*$	(?i)^[ ]DenyGroups[ ]+((?:[^ \n]+[ ])+)$	1

Ensure SSH LoginGraceTime is configured

Rule ID xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_set_login_grace_time:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis	5.1.14
pcidss4	2.2.6, 2.2

Description

The LoginGraceTime parameter to the SSH server specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate limits to ensure the service is available for needed access.

Rationale

Setting the LoginGraceTime parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. It will also limit the number of concurrent unauthenticated connections.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

LoginGraceTime is configured oval:ssg-test_sshd_login_grace_time:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sshd_login_grace_time:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[\s](?i)LoginGraceTime[\s]+(\d+)[\s](?:#.*)?$	1

tests the value of LoginGraceTime setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_set_login_grace_time_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	LoginGraceTime 60

Verify that the value of LoginGraceTime is present oval:ssg-test_LoginGraceTime_present_sshd_set_login_grace_time:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	LoginGraceTime 60

Set SSH Daemon LogLevel to VERBOSE

Rule ID xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_set_loglevel_verbose:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

disa	CCI-000067
nerc-cip	CIP-007-3 R7.1
nist	AC-17(a), AC-17(1), CM-6(a)
pcidss	Req-2.2.4
os-srg	SRG-OS-000032-GPOS-00013
cis	5.1.15
pcidss4	2.2.6, 2.2

Description

The VERBOSE parameter configures the SSH daemon to record login and logout activity. To specify the log level in SSH, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:

LogLevel VERBOSE

Rationale

SSH provides several logging levels with varying amounts of verbosity. DEBUG is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. INFO or VERBOSE level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of LogLevel setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_set_loglevel_verbose:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sshd_set_loglevel_verbose:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[ \t](?i)LogLevel(?-i)[ \t]+(.+?)[ \t](?:$\|#)	1

tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	LogLevel VERBOSE

Verify that the value of LogLevel is present oval:ssg-test_LogLevel_present_sshd_set_loglevel_verbose:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	LogLevel VERBOSE

Set SSH authentication attempt limit

Rule ID xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_set_max_auth_tries:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

ism	0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561
cis	5.1.16
pcidss4	2.2.6, 2.2

Description

The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. to set MaxAUthTries edit /etc/ssh/sshd_config as follows:

MaxAuthTries 4

Rationale

Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

MaxAuthTries is configured oval:ssg-test_sshd_max_auth_tries:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sshd_max_auth_tries:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[\s](?i)MaxAuthTries[\s]+(\d+)[\s](?:#.*)?$	1

tests the value of MaxAuthTries setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_set_max_auth_tries_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	MaxAuthTries 4

Verify that the value of MaxAuthTries is present oval:ssg-test_MaxAuthTries_present_sshd_set_max_auth_tries:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	MaxAuthTries 4

Set SSH MaxSessions limit

Rule ID xccdf_org.ssgproject.content_rule_sshd_set_max_sessions

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_set_max_sessions:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis	5.1.18
pcidss4	2.2.6, 2.2

Description

The MaxSessions parameter specifies the maximum number of open sessions permitted from a given connection. To set MaxSessions edit /etc/ssh/sshd_config as follows:

MaxSessions 10

Rationale

To protect a system from denial of service due to a large number of concurrent sessions, use the rate limiting function of MaxSessions to protect availability of sshd logins and prevent overwhelming the daemon.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

MaxSessions is configured oval:ssg-test_sshd_max_sessions:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sshd_max_sessions:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/ssh/sshd_config	^[\s](?i)MaxSessions[\s]+(\d+)[\s](?:#.*)?$	1

tests the value of MaxSessions setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_set_max_sessions_config_dir:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	MaxSessions 10

Verify that the value of MaxSessions is present oval:ssg-test_MaxSessions_present_sshd_set_max_sessions:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
not evaluated	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	MaxSessions 10

Ensure SSH MaxStartups is configured

Rule ID xccdf_org.ssgproject.content_rule_sshd_set_maxstartups

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_set_maxstartups:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis	5.1.17
pcidss4	2.2.6, 2.2

Description

The MaxStartups parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. To configure MaxStartups, you should add or edit the following line in the /etc/ssh/sshd_config file:

MaxStartups 10:30:60

Rationale

To protect a system from denial of service due to a large number of pending authentication connection attempts, use the rate limiting function of MaxStartups to protect availability of sshd logins and prevent overwhelming the daemon.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

SSH MaxStartups start parameter is less than or equal to the expected value oval:ssg-tst_maxstartups_start_parameter:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	MaxStartups 10:30:60

SSH MaxStartups rate parameter is greater than or equal to the expected value oval:ssg-tst_maxstartups_rate_parameter:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	MaxStartups 10:30:60

SSH MaxStartups full parameter is less than or equal to the expected value oval:ssg-tst_maxstartups_full_parameter:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Path	Content
true	/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf	MaxStartups 10:30:60

Use Only Strong Key Exchange algorithms

Rule ID xccdf_org.ssgproject.content_rule_sshd_use_strong_kex

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_use_strong_kex:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

pcidss	Req-2.3
cis	5.1.5
pcidss4	2.2.7, 2.2

Description

Limit the Key Exchange to strong algorithms. The following line in /etc/ssh/sshd_config demonstrates use of those:

KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

Rationale

Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of KexAlgorithms setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_use_strong_kex:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value	Value	Value
true	oval:ssg-var_sshd_config_kex:var:1	-diffie-hellman-group1-sha1	diffie-hellman-group14-sha1	diffie-hellman-group-exchange-sha1

Use Only Strong MACs

Rule ID xccdf_org.ssgproject.content_rule_sshd_use_strong_macs

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-sshd_use_strong_macs:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

disa	CCI-001453
nist	AC-17 (2)
os-srg	SRG-OS-000250-GPOS-00093
cis	5.1.6

Description

Limit the MACs to strong hash algorithms. The following line in /etc/ssh/sshd_config demonstrates use of those MACs:

MACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]

Rationale

MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
false	oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value
true	oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
not evaluated	openssh-server	x86_64	(none)	45.el9	8.7p1	0:8.7p1-45.el9	d36cb86cb86b3716	openssh-server-0:8.7p1-45.el9.x86_64

tests the value of MACs setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_use_strong_macs:tst:1 true

Following items have been found on the system:

Result of item-state comparison	Var ref	Value	Value	Value	Value	Value	Value	Value	Value	Value	Value
true	oval:ssg-var_sshd_config_strong_macs:var:1	-hmac-md5	hmac-md5-96	hmac-ripemd160	hmac-sha1-96	[email protected]	[email protected]	[email protected]	[email protected]	[email protected]	[email protected]

Verify Group Who Owns SSH Server config file

Rule ID xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupowner_sshd_config:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-17(a), CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	5.1.1

Description

To properly set the group owner of /etc/ssh/sshd_config, run the command:

$ sudo chgrp root /etc/ssh/sshd_config

Rationale

OVAL test results details

Testing group ownership of /etc/ssh/sshd_config oval:ssg-test_file_groupowner_sshd_config_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupowner_sshd_config_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/ssh/sshd_config	oval:ssg-symlink_file_groupowner_sshd_config_uid_0:ste:1	oval:ssg-state_file_groupowner_sshd_config_gid_0_0:ste:1

Verify Group Ownership on SSH Server Private *_key Key Files

Rule ID xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupownership_sshd_private_key:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

anssi	R50
cis	5.1.2

Description

SSH server private keys, files that match the /etc/ssh/*_key glob, must be group-owned by ssh_keys group.

Rationale

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

Warnings

warning Remediation is not possible at bootable container build time because SSH host keys are generated post-deployment.

OVAL test results details

Testing group ownership of /etc/ssh/ oval:ssg-test_file_groupownership_sshd_private_key_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownership_sshd_private_key_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/ssh	^.*_key$	oval:ssg-symlink_file_groupownership_sshd_private_key_uid_ssh_keys:ste:1	oval:ssg-state_file_groupownership_sshd_private_key_gid_ssh_keys_0:ste:1

Verify Group Ownership on SSH Server Public *.pub Key Files

Rule ID xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_groupownership_sshd_pub_key:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

anssi	R50
cis	5.1.3

Description

SSH server public keys, files that match the /etc/ssh/*.pub glob, must be group-owned by root group.

Rationale

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Warnings

warning Remediation is not possible at bootable container build time because SSH host keys are generated post-deployment.

OVAL test results details

Testing group ownership of /etc/ssh/ oval:ssg-test_file_groupownership_sshd_pub_key_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownership_sshd_pub_key_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/ssh	^.*\.pub$	oval:ssg-symlink_file_groupownership_sshd_pub_key_uid_0:ste:1	oval:ssg-state_file_groupownership_sshd_pub_key_gid_0_0:ste:1

Verify Owner on SSH Server config file

Rule ID xccdf_org.ssgproject.content_rule_file_owner_sshd_config

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_owner_sshd_config:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-17(a), CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	5.1.1

Description

To properly set the owner of /etc/ssh/sshd_config, run the command:

$ sudo chown root /etc/ssh/sshd_config

Rationale

OVAL test results details

Testing user ownership of /etc/ssh/sshd_config oval:ssg-test_file_owner_sshd_config_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_owner_sshd_config_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/ssh/sshd_config	oval:ssg-symlink_file_owner_sshd_config_uid_0:ste:1	oval:ssg-state_file_owner_sshd_config_uid_0_0:ste:1

Verify Ownership on SSH Server Private *_key Key Files

Rule ID xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_ownership_sshd_private_key:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

anssi	R50
cis	5.1.2

Description

SSH server private keys, files that match the /etc/ssh/*_key glob, must be owned by root user.

Rationale

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

Warnings

warning Remediation is not possible at bootable container build time because SSH host keys are generated post-deployment.

OVAL test results details

Testing user ownership of /etc/ssh/ oval:ssg-test_file_ownership_sshd_private_key_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownership_sshd_private_key_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/ssh	^.*_key$	oval:ssg-symlink_file_ownership_sshd_private_key_uid_0:ste:1	oval:ssg-state_file_ownership_sshd_private_key_uid_0_0:ste:1

Verify Ownership on SSH Server Public *.pub Key Files

Rule ID xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_ownership_sshd_pub_key:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

anssi	R50
cis	5.1.3

Description

SSH server public keys, files that match the /etc/ssh/*.pub glob, must be owned by root user.

Rationale

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Warnings

warning Remediation is not possible at bootable container build time because SSH host keys are generated post-deployment.

OVAL test results details

Testing user ownership of /etc/ssh/ oval:ssg-test_file_ownership_sshd_pub_key_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownership_sshd_pub_key_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/ssh	^.*\.pub$	oval:ssg-symlink_file_ownership_sshd_pub_key_uid_0:ste:1	oval:ssg-state_file_ownership_sshd_pub_key_uid_0_0:ste:1

Verify Permissions on SSH Server config file

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_sshd_config

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_sshd_config:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-17(a), CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	5.1.1
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/ssh/sshd_config, run the command:

$ sudo chmod 0600 /etc/ssh/sshd_config

Rationale

OVAL test results details

Testing mode of /etc/ssh/sshd_config oval:ssg-test_file_permissions_sshd_config_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_sshd_config_0:obj:1 of type file_object

Filepath	Filter	Filter
/etc/ssh/sshd_config	oval:ssg-exclude_symlinks__sshd_config:ste:1	oval:ssg-state_file_permissions_sshd_config_0_mode_0600or_stricter_:ste:1

Verify Permissions on SSH Server Private *_key Key Files

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_sshd_private_key:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
cui	3.1.13, 3.13.10
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-17(a), CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-2.2.4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	5.1.2
pcidss4	2.2.6, 2.2

Description

SSH server private keys - files that match the /etc/ssh/*_key glob, have to have restricted permissions. If those files are owned by the root user and the root group, they have to have the 0600 permission or stricter. If they are owned by the root user, but by a dedicated group ssh_keys, they can have the 0640 permission or stricter.

Rationale

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

Warnings

warning Remediation is not possible at bootable container build time because SSH host keys are generated post-deployment.

OVAL test results details

No keys that have unsafe ownership/permissions combination exist oval:ssg-test_no_offending_keys:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_offending_keys:obj:1 of type file_object

Path	Filename	Filter	Filter	Filter
/etc/ssh	.*_key$	oval:ssg-exclude_symlinks__sshd_private_key:ste:1	oval:ssg-filter_ssh_key_owner_root:ste:1	oval:ssg-filter_ssh_key_owner_ssh_keys:ste:1

Verify Permissions on SSH Server Public *.pub Key Files

Rule ID xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key

Result

pass

Multi-check rule no

OVAL Definition ID oval:ssg-file_permissions_sshd_pub_key:def:1

Time 2025-06-26T17:28:58+00:00

Severity medium

References:

cis-csc	12, 13, 14, 15, 16, 18, 3, 5
cobit5	APO01.06, DSS05.04, DSS05.07, DSS06.02
cui	3.1.13, 3.13.10
disa	CCI-000366
isa-62443-2009	4.3.3.7.3
isa-62443-2013	SR 2.1, SR 5.2
iso27001-2013	A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5
nerc-cip	CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2
nist	AC-17(a), CM-6(a), AC-6(1)
nist-csf	PR.AC-4, PR.DS-5
pcidss	Req-2.2.4
os-srg	SRG-OS-000480-GPOS-00227
anssi	R50
cis	5.1.3
pcidss4	2.2.6, 2.2

Description

To properly set the permissions of /etc/ssh/*.pub, run the command:

$ sudo chmod 0644 /etc/ssh/*.pub

Rationale

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Warnings

warning Remediation is not possible at bootable container build time because SSH host keys are generated post-deployment.

OVAL test results details

Testing mode of /etc/ssh/ oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/ssh	^.*\.pub$	oval:ssg-exclude_symlinks__sshd_pub_key:ste:1	oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1

Scroll back to the first rule

Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.