UCF STIG Viewer Logo

Oracle Linux 8 Security Technical Implementation Guide


Overview

Date Finding Count (378)
2022-09-07 CAT I (High): 21 CAT II (Med): 327 CAT III (Low): 30
STIG Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Available Profiles



Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-248521 High OL 8 must be a vendor-supported release.
V-248524 High OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
V-248598 High There must be no ".shosts" files on the OL 8 operating system.
V-248597 High There must be no "shosts.equiv" files on the OL 8 operating system.
V-248874 High The root account must be the only account having unrestricted access to the OL 8 system.
V-248870 High The x86 Ctrl-Alt-Delete key sequence in OL 8 must be disabled if a graphical user interface is installed.
V-248873 High The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for OL 8 operational support.
V-248903 High A File Transfer Protocol (FTP) server package must not be installed unless mission essential on OL 8.
V-248650 High OL 8 must not allow users to override SSH environment variables.
V-248715 High OL 8 must not allow blank or null passwords in the system-auth file.
V-248714 High OL 8 must not allow accounts configured with blank or null passwords.
V-248716 High OL 8 must not allow blank or null passwords in the password-auth file.
V-248575 High OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
V-248574 High YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization.
V-252650 High The OL 8 operating system must not have accounts configured with blank or null passwords.
V-248823 High OL 8 must not have the telnet-server package installed.
V-248827 High OL 8 must not have the rsh-server package installed.
V-248537 High OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.
V-248540 High OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.
V-248869 High The x86 Ctrl-Alt-Delete key sequence must be disabled on OL 8.
V-248649 High Unattended or automatic logon via the OL 8 graphical user interface must not be allowed.
V-248733 Medium OL 8 audit logs must be owned by root to prevent unauthorized read access.
V-248732 Medium OL 8 audit logs must have a mode of "0600" or less permissive to prevent unauthorized read access.
V-248731 Medium OL 8 must resolve audit information before writing to disk.
V-248730 Medium OL 8 must label all offloaded audit logs before sending them to the central log server.
V-248737 Medium The OL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.
V-248736 Medium The OL 8 audit log directory must be group-owned by root to prevent unauthorized read access.
V-248735 Medium The OL 8 audit log directory must be owned by root to prevent unauthorized read access.
V-248734 Medium OL 8 audit logs must be group-owned by root to prevent unauthorized read access.
V-248739 Medium The OL 8 audit system must protect logon UIDs from unauthorized change.
V-248738 Medium The OL 8 audit system must protect auditing rules from unauthorized change.
V-248607 Medium The OL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements.
V-248606 Medium The OL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements.
V-248605 Medium The OL 8 SSH daemon must not allow authentication using known host's authentication.
V-248604 Medium The OL 8 SSH daemon must not allow compression or must only allow compression after successful authentication.
V-248603 Medium The OL 8 SSH daemon must perform strict mode checking of home directory configuration files.
V-248602 Medium The OL 8 SSH private host key files must have mode "0600" or less permissive.
V-248601 Medium The OL 8 SSH public host key files must have mode "0644" or less permissive.
V-248784 Medium OL 8 must generate audit records for any use of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
V-248782 Medium OL 8 must generate audit records for any use of the "crontab" command.
V-248783 Medium OL 8 must generate audit records for any use of the "chsh" command.
V-248781 Medium OL 8 must generate audit records for any use of the delete_module syscall.
V-248559 Medium The OL 8 "/var/log" directory must be group-owned by root.
V-248558 Medium The OL 8 "/var/log" directory must be owned by root.
V-248553 Medium OL 8 must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity.
V-248552 Medium OL 8 must be configured so that all network connections associated with SSH traffic are terminate after a period of inactivity.
V-248551 Medium A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources.
V-248557 Medium The OL 8 "/var/log" directory must have mode 0755 or less permissive.
V-248556 Medium The OL 8 "/var/log/messages" file must be group-owned by root.
V-248555 Medium The OL 8 "/var/log/messages" file must be owned by root.
V-248554 Medium The OL 8 "/var/log/messages" file must have mode 0640 or less permissive.
V-248858 Medium OL 8 must mount "/var/tmp" with the "noexec" option.
V-248859 Medium The OL 8 "fapolicy" module must be installed.
V-248852 Medium OL 8 must mount "/var/log" with the "noexec" option.
V-248853 Medium OL 8 must mount "/var/log/audit" with the "nodev" option.
V-248850 Medium OL 8 must mount "/var/log" with the "nodev" option.
V-248851 Medium OL 8 must mount "/var/log" with the "nosuid" option.
V-248856 Medium OL 8 must mount "/var/tmp" with the "nodev" option.
V-248857 Medium OL 8 must mount "/var/tmp" with the "nosuid" option.
V-248854 Medium OL 8 must mount "/var/log/audit" with the "nosuid" option.
V-248855 Medium OL 8 must mount "/var/log/audit" with the "noexec" option.
V-248676 Medium OL 8 must ensure session control is automatically started at shell initialization.
V-248674 Medium OL 8 must have the tmux package installed.
V-248675 Medium OL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions.
V-248672 Medium OL 8 must initiate a session lock for graphical user interfaces when the screensaver is activated.
V-248673 Medium OL 8 must disable the user list at logon for graphical user interfaces.
V-248670 Medium OL 8 systems below version 8.2 must configure SELinux context type to allow the use of a non-default faillock tally directory.
V-248671 Medium OL 8 must enable a user session lock until that user reestablishes access using established identification and authentication procedures for graphical user sessions.
V-248678 Medium OL 8 must enable a user session lock until that user reestablishes access using established identification and authentication procedures for command line sessions.
V-248679 Medium OL 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed.
V-248779 Medium OL 8 must generate audit records for any use of the "gpasswd" command.
V-248774 Medium OL 8 must generate audit records for any use of the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls.
V-248773 Medium OL 8 must generate audit records for any use of the "init_module" and "finit_module" system calls.
V-248772 Medium OL 8 must generate audit records for any use of the "newgrp" command.
V-248771 Medium OL 8 must generate audit records for any use of the "pam_timestamp_check" command.
V-248770 Medium OL 8 must generate audit records for any use of the "setfacl" command.
V-248519 Medium The OL 8 audit package must be installed.
V-248894 Medium OL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler.
V-248895 Medium OL 8 must be configured to prevent unrestricted mail relaying.
V-248892 Medium OL 8 must disable the use of user namespaces.
V-248893 Medium OL 8 must use reverse path filtering on all IPv4 interfaces.
V-248890 Medium OL 8 must restrict the use of "ptrace" to descendant processes.
V-248891 Medium OL 8 must restrict exposed kernel pointer addresses access.
V-248898 Medium The graphical display manager must not be installed on OL 8 unless approved.
V-248899 Medium OL 8 network interfaces must not be in promiscuous mode.
V-248588 Medium OL 8 must accept Personal Identity Verification (PIV) credentials.
V-248589 Medium OL 8 must implement non-executable data to protect its memory from unauthorized code execution.
V-248584 Medium OL 8 must use the invoking user's password for privilege escalation when using "sudo".
V-248585 Medium OL 8 must require re-authentication when using the "sudo" command.
V-248587 Medium OL 8 must implement certificate status checking for multifactor authentication.
V-248581 Medium OL 8 must require users to provide a password for privilege escalation.
V-248582 Medium OL 8 must require users to reauthenticate for privilege escalation and changing roles.
V-248583 Medium OL 8 must restrict privilege elevation to authorized personnel.
V-248801 Medium OL 8 must generate audit records for any attempted modifications to the "faillock" log file.
V-248800 Medium OL 8 must generate audit records for any use of the "kmod" command.
V-248803 Medium OL 8 must enable auditing of processes that start prior to the audit daemon.
V-248802 Medium OL 8 must generate audit records for any attempted modifications to the "lastlog" file.
V-248805 Medium OL 8 must enable Linux audit logging for the USBGuard daemon.
V-248807 Medium OL 8 audit tools must have a mode of "0755" or less permissive.
V-248806 Medium OL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
V-248809 Medium OL 8 audit tools must be group-owned by root.
V-248808 Medium OL 8 audit tools must be owned by root.
V-248706 Medium The OL 8 lastlog command must be owned by root.
V-248707 Medium The OL 8 lastlog command must be group-owned by root.
V-248704 Medium The OL 8 password-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.
V-248705 Medium The OL 8 lastlog command must have a mode of "0750" or less permissive.
V-248702 Medium OL 8 must implement multifactor authentication for access to interactive accounts.
V-248703 Medium The OL 8 system-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.
V-248700 Medium OL 8 passwords for new users must have a minimum of 15 characters.
V-248701 Medium OL 8 duplicate User IDs (UIDs) must not exist for interactive users.
V-248708 Medium OL 8 emergency accounts must be automatically removed or disabled after the crisis is resolved or within 72 hours.
V-248632 Medium OL 8 must disable storing core dumps.
V-248633 Medium OL 8 must disable core dump backtraces.
V-248630 Medium OL 8 must disable acquiring, saving, and processing core dumps.
V-248631 Medium OL 8 must disable core dumps for all users.
V-248636 Medium All OL 8 world-writable directories must be owned by root, sys, bin, or an application user.
V-248637 Medium All OL 8 world-writable directories must be group-owned by root, sys, bin, or an application group.
V-248634 Medium For OL 8 systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured.
V-248635 Medium Executable search paths within the initialization files of all local interactive OL 8 users must only contain paths that resolve to the system default or the user's home directory.
V-248638 Medium All OL 8 local interactive users must have a home directory assigned in the "/etc/passwd" file.
V-248639 Medium All OL 8 local interactive user home directories must have mode "0750" or less permissive.
V-248791 Medium OL 8 must generate audit records for any use of the "chmod", "fchmod", and "fchmodat" system calls.
V-248790 Medium OL 8 must generate audit records for any use of the "chown", "fchown", "fchownat", and "lchown" system calls.
V-248797 Medium OL 8 must generate audit records for any use of the "sudo" command.
V-248799 Medium OL 8 must generate audit records for any use of the "chacl" command.
V-248798 Medium OL 8 must generate audit records for any use of the "usermod" command.
V-248568 Medium OL 8 system commands must be owned by root.
V-248569 Medium OL 8 system commands must be group-owned by root or a system account.
V-248566 Medium The OL 8 operating system must implement DoD-approved TLS encryption in the GnuTLS package.
V-248567 Medium OL 8 system commands must have mode 755 or less permissive.
V-248564 Medium The OL 8 operating system must implement DoD-approved encryption in the OpenSSL package.
V-248565 Medium The OL 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package.
V-248562 Medium The OL 8 SSH server must be configured to use only ciphers employing FIPS 140-2 validated cryptographic algorithms.
V-248560 Medium The OL 8 SSH daemon must be configured to use system-wide crypto policies.
V-248561 Medium The OL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.
V-248849 Medium OL 8 must mount "/tmp" with the "noexec" option.
V-248848 Medium OL 8 must mount "/tmp" with the "nosuid" option.
V-248845 Medium OL 8 must mount "/dev/shm" with the "nosuid" option.
V-248844 Medium OL 8 must mount "/dev/shm" with the "nodev" option.
V-248847 Medium OL 8 must mount "/tmp" with the "nodev" option.
V-248846 Medium OL 8 must mount "/dev/shm" with the "noexec" option.
V-248841 Medium A firewall must be active on OL 8.
V-248840 Medium A firewall must be installed on OL 8.
V-248843 Medium OL 8 Bluetooth must be disabled.
V-248842 Medium OL 8 wireless network adapters must be disabled.
V-248839 Medium An OL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
V-248830 Medium OL 8 must not have the Controller Area Network (CAN) kernel module installed if not required for operational support.
V-248831 Medium OL 8 must not have the stream control transmission protocol (SCTP) kernel module installed if not required for operational support.
V-248835 Medium OL 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
V-248836 Medium The OL 8 file system automounter must be disabled unless required.
V-248837 Medium OL 8 must be configured to disable the ability to use USB mass storage devices.
V-248694 Medium OL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in "/etc/shadow".
V-248695 Medium OL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in "/etc/login.defs".
V-248696 Medium OL 8 user account passwords must have a 60-day maximum password lifetime restriction.
V-248697 Medium OL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime.
V-248690 Medium OL 8 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
V-248691 Medium OL 8 must require the maximum number of repeating characters be limited to three when passwords are changed.
V-248692 Medium OL 8 must require the change of at least four character classes when passwords are changed.
V-248699 Medium OL 8 passwords must have a minimum of 15 characters.
V-248669 Medium OL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the use of a non-default faillock tally directory.
V-248668 Medium OL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.
V-248740 Medium OL 8 must generate audit records for all account creation events that affect "/etc/shadow".
V-248741 Medium OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
V-248746 Medium OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
V-248747 Medium OL 8 must generate audit records for any use of the "su" command.
V-248744 Medium OL 8 must generate audit records for all account creation events that affect "/etc/group".
V-248745 Medium OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
V-248661 Medium OL 8 systems, versions 8.2 and above, must prevent system messages from being presented when three unsuccessful logon attempts occur.
V-248660 Medium OL 8 systems below version 8.2 must prevent system messages from being presented when three unsuccessful logon attempts occur.
V-248748 Medium The OL 8 audit system must be configured to audit any use of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
V-248662 Medium OL 8 systems below version 8.2 must log user name information when unsuccessful logon attempts occur.
V-248665 Medium OL 8 systems, versions 8.2 and above, must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-248664 Medium OL 8 systems below version 8.2 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-248667 Medium OL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
V-248528 Medium OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
V-248529 Medium OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.
V-248522 Medium The OL 8 operating system must implement the Endpoint Security for Linux Threat Prevention tool.
V-248523 Medium OL 8 vendor-packaged system security patches and updates must be installed and up to date.
V-248520 Medium OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
V-248526 Medium OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via an SSH logon.
V-248527 Medium OL 8 must display a banner before granting local or remote access to the system via a graphical user logon.
V-248525 Medium All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.
V-248889 Medium OL 8 must disable access to the network "bpf" syscall from unprivileged processes.
V-248888 Medium OL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
V-248881 Medium OL 8 must not forward IPv4 source-routed packets by default.
V-248880 Medium OL 8 must not forward IPv6 source-routed packets.
V-248883 Medium OL 8 must not enable IPv6 packet forwarding unless the system is a router.
V-248882 Medium OL 8 must not forward IPv6 source-routed packets by default.
V-248885 Medium OL 8 must not accept router advertisements on all IPv6 interfaces by default.
V-248884 Medium OL 8 must not accept router advertisements on all IPv6 interfaces.
V-248887 Medium OL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages.
V-248886 Medium OL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
V-248611 Medium OL 8 must use a separate file system for "/tmp".
V-248596 Medium OL 8 must enable the SELinux targeted policy.
V-248594 Medium OL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.
V-248593 Medium OL 8 must not let Meltdown and Spectre exploit critical vulnerabilities in modern processors.
V-248592 Medium OL 8 must clear SLUB/SLAB objects to prevent use-after-free attacks.
V-248591 Medium OL 8 must disable virtual syscalls.
V-248590 Medium OL 8 must clear the page allocator to prevent use-after-free attacks.
V-248875 Medium OL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
V-248876 Medium OL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
V-248877 Medium OL 8 must not send Internet Control Message Protocol (ICMP) redirects.
V-248871 Medium OL 8 must disable the systemd Ctrl-Alt-Delete burst key sequence.
V-248878 Medium OL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
V-248879 Medium OL 8 must not forward IPv4 source-routed packets.
V-248900 Medium OL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements.
V-248901 Medium The OL 8 SSH daemon must prevent remote hosts from connecting to the proxy display.
V-248902 Medium If the Trivial File Transfer Protocol (TFTP) server is required, the OL 8 TFTP daemon must be configured to operate in secure mode.
V-248904 Medium OL 8 must not have the "gssproxy" package installed if not required for operational support.
V-248905 Medium OL 8 must not have the "iprutils" package installed if not required for operational support.
V-248906 Medium OL 8 must not have the "tuned" package installed if not required for operational support.
V-248907 Medium OL 8 must prevent non-privileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures.
V-248651 Medium OL 8 temporary user accounts must be provisioned with an expiration time of 72 hours or less.
V-248652 Medium OL 8 systems below version 8.2 must automatically lock an account when three unsuccessful logon attempts occur.
V-248653 Medium OL 8 systems, versions 8.2 and above, must automatically lock an account when three unsuccessful logon attempts occur.
V-248654 Medium OL 8 systems below version 8.2 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
V-248655 Medium OL 8 systems, versions 8.2 and above, must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
V-248656 Medium OL 8 systems below version 8.2 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-248657 Medium OL 8 systems, versions 8.2 and above, must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
V-248658 Medium OL 8 systems below version 8.2 must ensure account lockouts persist.
V-248659 Medium OL 8 systems, versions 8.2 and above, must ensure account lockouts persist.
V-248625 Medium OL 8 file systems must not interpret character or block special devices that are imported via NFS.
V-248624 Medium OL 8 file systems must not execute binary files that are imported via Network File System (NFS).
V-248627 Medium Local OL 8 initialization files must not execute world-writable programs.
V-248626 Medium OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).
V-248621 Medium OL 8 file systems must not interpret character or block special devices from untrusted file systems.
V-248620 Medium OL 8 file systems that contain user home directories must not execute binary files.
V-248623 Medium OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.
V-248622 Medium OL 8 file systems must not execute binary files on removable media.
V-248629 Medium OL 8 must disable the "kernel.core_pattern".
V-248628 Medium OL 8 must disable kernel dumps unless needed.
V-248719 Medium OL 8 default permissions must be defined in such a way that all authenticated users can read and modify only their own files.
V-248718 Medium OL 8 must display the date and time of the last successful account logon upon an SSH logon.
V-248711 Medium OL 8 must prevent the use of dictionary words for passwords.
V-248710 Medium OL 8 must prohibit the use of cached authentications after one day.
V-248713 Medium OL 8 must not have unnecessary accounts.
V-248712 Medium OL 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
V-248571 Medium OL 8 library files must be owned by root.
V-248570 Medium OL 8 library files must have mode 755 or less permissive.
V-248573 Medium The OL 8 file integrity tool must notify the System Administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency.
V-248572 Medium OL 8 library files must be group-owned by root.
V-248577 Medium OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks.
V-248576 Medium OL 8 must prevent the loading of a new kernel for later execution.
V-248578 Medium OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on hardlinks.
V-252659 Medium OL 8 systems below version 8.4 must ensure the password complexity module in the password-auth file is configured for three retries or less.
V-252658 Medium OL 8 systems below version 8.4 must ensure the password complexity module in the system-auth file is configured for three retries or less.
V-252657 Medium OL 8 must ensure the password complexity module is enabled in the system-auth file.
V-252656 Medium The OL 8 operating system must not be configured to bypass password requirements for privilege escalation.
V-252655 Medium OL 8 must specify the default "include" directory for the /etc/sudoers file.
V-252654 Medium The OL 8 operating system must use a file integrity tool to verify correct operation of all security functions.
V-252653 Medium OL 8 library directories must be group-owned by root or a system account.
V-252652 Medium OL 8 library directories must be owned by root.
V-252651 Medium OL 8 library directories must have mode 755 or less permissive.
V-248663 Medium OL 8 systems, versions 8.2 and above, must log user name information when unsuccessful logon attempts occur.
V-248829 Medium OL 8 must not have the asynchronous transfer mode (ATM) kernel module installed if not required for operational support.
V-248828 Medium OL 8 must cover or disable the built-in or attached camera when not in use.
V-248820 Medium OL 8 must compare internal information system clocks at least every 24 hours with a server synchronized to an authoritative time source, such as the United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
V-248825 Medium OL 8 must not have the sendmail package installed.
V-248824 Medium OL 8 must not have any automated bug reporting tools installed.
V-248720 Medium OL 8 must set the umask value to 077 for all local interactive user accounts.
V-248721 Medium OL 8 must define default permissions for logon and non-logon shells.
V-248722 Medium The OL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software.
V-248723 Medium Cron logging must be implemented in OL 8.
V-248724 Medium The OL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
V-248725 Medium The OL 8 Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) must have mail aliases to be notified of an audit processing failure.
V-248726 Medium The OL 8 System must take appropriate action when an audit processing failure occurs.
V-248728 Medium The OL 8 audit system must take appropriate action when the audit storage volume is full.
V-248729 Medium The OL 8 audit system must audit local events.
V-248686 Medium OL 8 must ensure the password complexity module is enabled in the password-auth file.
V-248685 Medium OL 8 must map the authenticated identity to the user or group account for PKI-based authentication.
V-248684 Medium OL 8 must prevent a user from overriding the session lock-enabled setting for the graphical user interface.
V-248683 Medium OL 8 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
V-248682 Medium OL 8 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
V-248681 Medium OL 8 must automatically lock command line user sessions after 15 minutes of inactivity.
V-248680 Medium OL 8 must automatically lock graphical user sessions after 15 minutes of inactivity.
V-248754 Medium OL 8 must generate audit records for any uses of the "chcon" command.
V-248757 Medium OL 8 must generate audit records for any use of the "passwd" command.
V-248756 Medium OL 8 must generate audit records for any use of the "ssh-agent" command.
V-248618 Medium OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
V-248619 Medium OL 8 must prevent special devices on non-root local partitions.
V-248753 Medium OL 8 must generate audit records for any use of the "chage" command.
V-248615 Medium OL 8 must have the rsyslog service enabled and active.
V-248616 Medium OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.
V-248617 Medium OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.
V-248759 Medium OL 8 must generate audit records for any use of the "umount" command.
V-248758 Medium OL 8 must generate audit records for any use of the "mount" command.
V-248612 Medium OL 8 must use a separate file system for /var/tmp.
V-248613 Medium OL 8 must not permit direct logons to the root account using remote access via SSH.
V-248539 Medium OL 8 operating systems booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.
V-248538 Medium OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance.
V-248535 Medium The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.
V-248534 Medium OL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.
V-248531 Medium OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
V-248530 Medium All OL 8 remote access methods must be monitored.
V-248533 Medium OL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.
V-248532 Medium OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
V-248742 Medium OL 8 must generate audit records for all account creation events that affect "/etc/passwd".
V-248743 Medium OL 8 must generate audit records for all account creation events that affect "/etc/gshadow".
V-248548 Medium OL 8 must use a Linux Security Module configured to enforce limits on system services.
V-248541 Medium OL 8 operating systems must require authentication upon booting into rescue mode.
V-248542 Medium OL 8 operating systems must require authentication upon booting into emergency mode.
V-248543 Medium The OL 8 "pam_unix.so" module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
V-248544 Medium The OL 8 "pam_unix.so" module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
V-248545 Medium OL 8 must prevent system daemons from using Kerberos for authentication.
V-248546 Medium The krb5-workstation package must not be installed on OL 8.
V-248547 Medium The krb5-server package must not be installed on OL 8.
V-248867 Medium All OL 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
V-248866 Medium All OL 8 networked systems must have SSH installed.
V-248865 Medium A firewall must be able to protect against or limit the effects of denial-of-service (DoS) attacks by ensuring OL 8 can implement rate-limiting measures on impacted network interfaces.
V-248864 Medium OL 8 must enable the USBGuard.
V-248863 Medium OL 8 must block unauthorized peripherals before establishing a connection.
V-248862 Medium OL 8 must have the USBGuard installed.
V-248861 Medium The OL 8 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
V-248860 Medium The OL 8 "fapolicy" module must be enabled.
V-248868 Medium OL 8 must force a frequent session key renegotiation for SSH connections to the server.
V-248643 Medium All OL 8 local interactive user home directories defined in the "/etc/passwd" file must exist.
V-248642 Medium OL 8 must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.
V-248641 Medium All OL 8 local interactive user home directories must be group-owned by the home directory owner's primary group.
V-248640 Medium All OL 8 local interactive user home directory files must have mode "0750" or less permissive.
V-248647 Medium All OL 8 files and directories must have a valid group owner.
V-248646 Medium All OL 8 files and directories must have a valid owner.
V-248645 Medium All OL 8 local initialization files must have mode "0740" or less permissive.
V-248644 Medium All OL 8 local interactive user accounts must be assigned a home directory upon creation.
V-248648 Medium A separate OL 8 filesystem must be used for user home directories (such as "/home" or an equivalent).
V-248768 Medium OL 8 must generate audit records for any use of the "unix_chkpwd" command.
V-248769 Medium OL 8 must generate audit records for any use of the "ssh-keysign" command.
V-248764 Medium OL 8 must generate audit records for any use of the "semanage" command.
V-248765 Medium OL 8 must generate audit records for any use of the "setfiles" command.
V-248766 Medium OL 8 must generate audit records for any use of the "userhelper" command.
V-248767 Medium OL 8 must generate audit records for any use of the "setsebool" command.
V-248760 Medium OL 8 must generate audit records for any use of the "mount" syscall.
V-248761 Medium OL 8 must generate audit records for any use of the "unix_update" command.
V-248762 Medium OL 8 must generate audit records for any use of the "postdrop" command.
V-248763 Medium OL 8 must generate audit records for any use of the "postqueue" command.
V-252662 Medium OL 8 must not enable IPv4 packet forwarding unless the system is a router.
V-252663 Medium The graphical display manager must not be the default target on OL 8 unless approved.
V-252660 Medium OL 8 systems, version 8.4 and above, must ensure the password complexity module is configured for three retries or less.
V-252661 Medium OL 8 must be configured in the system-auth file to prohibit password reuse for a minimum of five generations.
V-248818 Medium OL 8 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
V-248819 Medium OL 8 must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
V-248816 Medium OL 8 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited.
V-248817 Medium OL 8 must authenticate the remote logging server for offloading audit logs.
V-248814 Medium The OL 8 audit records must be offloaded onto a different system or storage media from the system being audited.
V-248815 Medium OL 8 must take appropriate action when the internal event queue is full.
V-248812 Medium OL 8 must have the packages required for offloading audit logs installed.
V-248813 Medium OL 8 must have the packages required for encrypting offloaded audit logs installed.
V-248810 Medium OL 8 must use cryptographic mechanisms to protect the integrity of audit tools.
V-248811 Medium OL 8 must allocate audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility.
V-248609 Low OL 8 must use a separate file system for "/var/log".
V-248608 Low OL 8 must use a separate file system for "/var".
V-248600 Low OL 8 must have the packages required to use the hardware random number generator entropy gatherer service.
V-248677 Low OL 8 must prevent users from disabling session control mechanisms.
V-248896 Low The OL 8 file integrity tool must be configured to verify extended attributes.
V-248897 Low The OL 8 file integrity tool must be configured to verify Access Control Lists (ACLs).
V-248586 Low OL 8 must have the package required for multifactor authentication installed.
V-248580 Low OL 8 must prevent kernel profiling by unprivileged users.
V-248804 Low OL 8 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
V-248709 Low All OL 8 passwords must contain at least one special character.
V-248563 Low The OL 8 SSH server must be configured to use strong entropy.
V-248832 Low OL 8 must disable the transparent inter-process communication (TIPC) protocol.
V-248833 Low OL 8 must disable mounting of cramfs.
V-248834 Low OL 8 must disable IEEE 1394 (FireWire) Support.
V-248693 Low OL 8 must require the change of at least 8 characters when passwords are changed.
V-248698 Low OL 8 must be configured in the password-auth file to prohibit password reuse for a minimum of five generations.
V-248666 Low OL 8 must limit the number of concurrent sessions to 10 for all accounts and/or account types.
V-248610 Low OL 8 must use a separate file system for the system audit data path.
V-248599 Low OL 8 must enable the hardware random number generator entropy gatherer service.
V-248595 Low YUM must remove all software components after updated versions have been installed on OL 8.
V-248872 Low OL 8 must disable the debug-shell systemd service.
V-248717 Low OL 8 must display the date and time of the last successful account logon upon logon.
V-248579 Low OL 8 must restrict access to the kernel message buffer.
V-248822 Low OL 8 must disable network management of the chrony daemon.
V-248821 Low OL 8 must disable the chrony daemon from acting as a server.
V-248826 Low OL 8 must enable mitigations against processor-based vulnerabilities.
V-248687 Low OL 8 must enforce password complexity by requiring that at least one uppercase character be used.
V-248689 Low OL 8 must enforce password complexity by requiring that at least one numeric character be used.
V-248688 Low OL 8 must enforce password complexity by requiring that at least one lowercase character be used.
V-248549 Low OL 8 must have the "policycoreutils" package installed.