STIGhubSTIGhub
STIGhub— A free STIG search and compliance tool·STIGs updated 23 hours ago
Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.
← Back to STIGs

Oracle Linux 9 Security Technical Implementation Guide

Version

V1R7

Release Date

Aug 21, 2026

SCAP Benchmark ID

Oracle_Linux_9_STIG

Total Checks

450

Tags

linux
CAT I: 29CAT II: 406CAT III: 15

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (450)

V-271431MEDIUMThe OL 9 operating system must implement cryptographic mechanisms to prevent unauthorized modification of all information at rest.V-271432LOWOL 9 must use a separate file system for the system audit data path.V-271433MEDIUMOL 9 must be configured so that a separate file system must be used for user home directories (such as /home or an equivalent).V-271434MEDIUMOL 9 must use a separate file system for /tmp.V-271435LOWOL 9 must use a separate file system for /var.V-271436LOWOL 9 must use a separate file system for /var/log.V-271437MEDIUMOL 9 must use a separate file system for /var/tmp.V-271438HIGHOL 9 must be a vendor supported release.V-271439MEDIUMOL 9 vendor packaged system security patches and updates must be installed and up to date.V-271440MEDIUMOL 9 must be configured so that the graphical display manager is not the default target unless approved.V-271441MEDIUMOL 9 must require authentication to access emergency mode.V-271442MEDIUMOL 9 must require authentication to access single-user mode.V-271443MEDIUMOL 9 must be configured to disable the Asynchronous Transfer Mode (ATM) kernel module.V-271444MEDIUMOL 9 must be configured to disable the Controller Area Network (CAN) kernel module.V-271445MEDIUMOL 9 must be configured to disable the FireWire kernel module.V-271446MEDIUMOL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.V-271447MEDIUMOL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.V-271448LOWOL 9 must disable mounting of cramfs.V-271449MEDIUMOL 9 Bluetooth must be disabled.V-271450MEDIUMOL 9 must be configured to disable USB mass storage.V-271451HIGHOL 9 must require a unique superuser's name upon booting into single-user and maintenance modes.V-271452HIGHOL 9 must use a Linux Security Module configured to enforce limits on system services.V-271453MEDIUMOL 9 must enable the SELinux targeted policy.V-271454HIGHOL 9 must enable FIPS mode.V-271455MEDIUMOL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a command line user logon.V-271456MEDIUMOL 9 must not have the nfs-utils package installed.V-271457MEDIUMOL 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.V-271458MEDIUMOL 9 must not have the telnet-server package installed.V-271459MEDIUMOL 9 must not have the gssproxy package installed.V-271460MEDIUMOL 9 must not have the iprutils package installed.V-271461MEDIUMOL 9 must not have the tuned package installed.V-271462HIGHOL 9 must not have a File Transfer Protocol (FTP) server package installed.V-271463HIGHOL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.V-271465MEDIUMOL 9 must not have a graphical display manager installed unless approved.V-271466MEDIUMOL 9 must not have the sendmail package installed.V-271467MEDIUMOL 9 must have policycoreutils package installed.V-271468MEDIUMOL 9 policycoreutils-python-utils package must be installed.V-271469MEDIUMOL 9 must have the firewalld package installed.V-271470MEDIUMOL 9 must be configured so that the firewalld service is active.V-271471MEDIUMOL 9 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.V-271472MEDIUMOL 9 must control remote access methods.V-271473MEDIUMOL 9 must be configured so that the firewall employs a deny-all, allow-by-exception policy for allowing connections to other systems.V-271474MEDIUMOL 9 must have the sudo package installed.V-271475MEDIUMOL 9 must use the invoking user's password for privilege escalation when using sudo.V-271476MEDIUMOL 9 must restrict privilege elevation to authorized personnel.V-271477HIGHOL 9 must have the crypto-policies package installed.V-271478HIGHOL 9 must implement a FIPS 140-3 compliant systemwide cryptographic policy.V-271479HIGHOL 9 must not allow the cryptographic policy to be overridden.V-271480MEDIUMOL 9 must be configured so that the cryptographic hashes of system files match vendor values.V-271482MEDIUMOL 9 networked systems must have SSH installed.V-271483MEDIUMOL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.V-271485HIGHOL 9 SSH server must be configured to use only ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.V-271486HIGHOL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.V-271487MEDIUMOL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a SSH logon.V-271488MEDIUMOL 9 must have the openssh-clients package installed.V-271489HIGHOL 9 SSH client must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.V-271490HIGHOL 9 SSH client must be configured to use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.V-271491MEDIUMOL 9 must have the openssl-pkcs11 package installed.V-271493MEDIUMOL 9 must have the SSSD package installed.V-271494MEDIUMOL 9 must use the SSSD package for multifactor authentication services.V-271495MEDIUMOL 9 must have the s-nail package installed.V-271496MEDIUMOL 9 must have the Advanced Intrusion Detection Environment (AIDE) package installed.V-271497MEDIUMOL 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator (SA) when anomalies in the operation of any security functions are discovered.V-271498MEDIUMOL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.V-271499LOWOL 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).V-271500LOWOL 9 must be configured so that the file integrity tool verifies extended attributes.V-271501MEDIUMOL 9 must have the chrony package installed.V-271502MEDIUMOL 9 must enable the chronyd service.V-271503MEDIUMOL 9 must have the USBGuard package installed.V-271504MEDIUMOL 9 must enable the USBGuard package.V-271506MEDIUMOL 9 must have the fapolicy module installed.V-271507MEDIUMOL 9 must enable the fapolicy module.V-271508MEDIUMOL 9 must have the rsyslog package installed.V-271509MEDIUMOL 9 must be configured so that the rsyslog service is active.V-271510MEDIUMOL 9 must have the packages required for encrypting offloaded audit logs installed.V-271511LOWOL 9 must enable the hardware random number generator entropy gatherer service.V-271512MEDIUMOL 9 must have the rng-tools package installed.V-271513MEDIUMOL 9 must have the nss-tools package installed.V-271514MEDIUMOL 9 must have the pcsc-lite package installed.V-271515MEDIUMOL 9 must have the opensc package installed.V-271516MEDIUMOL 9 must be configured so that the pcscd socket is active.V-271517MEDIUMOL 9 must have the libreswan package installed.V-271518MEDIUMOL 9 must have the gnutls-utils package installed.V-271519MEDIUMOL 9 must have the audit package installed.V-271520MEDIUMOL 9 audit service must be enabled.V-271521MEDIUMOL 9 must have the audispd-plugins package installed.V-271522LOWOL 9 must remove all software components after updated versions have been installed.V-271523HIGHOL 9 must check the GPG signature of locally installed software packages before installation.V-271524HIGHOL 9 must check the GPG signature of software packages originating from external software repositories before installation.V-271525HIGHOL 9 must have GPG signature verification enabled for all software repositories.V-271526MEDIUMOL 9 must ensure cryptographic verification of vendor software packages.V-271527MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.V-271528MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.V-271529MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.V-271530MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.V-271531MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.V-271532MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.V-271533MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.V-271534MEDIUMOL 9 must audit all uses of the unix_update command.V-271535MEDIUMOL 9 must audit all uses of the su command.V-271536MEDIUMOL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.V-271537MEDIUMOL 9 must audit all uses of the chage command.V-271538MEDIUMOL 9 must audit all uses of the chcon command.V-271539MEDIUMOL 9 must audit all uses of the setfacl command.V-271540MEDIUMOL 9 must audit all uses of the chsh command.V-271541MEDIUMOL 9 must audit all uses of the crontab command.V-271542MEDIUMOL 9 must audit all uses of the gpasswd command.V-271543MEDIUMOL 9 must audit all uses of the newgrp command.V-271544MEDIUMOL 9 must audit all uses of the pam_timestamp_check command.V-271545MEDIUMOL 9 must audit all uses of the passwd command.V-271546MEDIUMOL 9 must audit all uses of the postdrop command.V-271547MEDIUMOL 9 must audit all uses of the postqueue command.V-271548MEDIUMOL 9 must audit all uses of the ssh-agent command.V-271549MEDIUMOL 9 must audit all uses of the ssh-keysign command.V-271550MEDIUMOL 9 must audit all uses of the sudoedit command.V-271551MEDIUMOL 9 must audit all uses of the unix_chkpwd command.V-271552MEDIUMOL 9 must audit all uses of the userhelper command.V-271553MEDIUMOL 9 must audit all uses of the mount command.V-271554MEDIUMOL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.V-271555MEDIUMOL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.V-271556MEDIUMOL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.V-271557MEDIUMOL 9 must audit all uses of the semanage command.V-271558MEDIUMOL 9 must audit all uses of the setfiles command.V-271559MEDIUMOL 9 must audit all uses of the setsebool command.V-271560MEDIUMOL 9 must audit all uses of the chacl command.V-271561MEDIUMOL 9 must audit all uses of the sudo command.V-271562MEDIUMOL 9 must audit all uses of the usermod command.V-271563MEDIUMOL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.V-271564MEDIUMOL 9 must audit all uses of the delete_module system call.V-271565MEDIUMOL 9 must audit all uses of the init_module and finit_module system calls.V-271566MEDIUMOL 9 must audit all uses of the kmod command.V-271567MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.V-271568MEDIUMOL 9 must audit all uses of umount system calls.V-271569MEDIUMOL 9 must use cryptographic mechanisms to protect the integrity of audit tools.V-271570MEDIUMOL 9 must audit uses of the execve system call.V-271571MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.V-271572MEDIUMOL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.V-271573MEDIUMOL 9 must be configured so that successful/unsuccessful uses of the init command generate an audit record.V-271574MEDIUMOL 9 must be configured so that successful/unsuccessful uses of the poweroff command generate an audit record.V-271575MEDIUMOL 9 must be configured so that successful/unsuccessful uses of the reboot command generate an audit record.V-271576MEDIUMOL 9 must be configured so that successful/unsuccessful uses of the shutdown command generate an audit record.V-271577LOWOL 9 must enable auditing of processes that start prior to the audit daemon.V-271578MEDIUMOL 9 must label all offloaded audit logs before sending them to the central log server.V-271579MEDIUMOL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs.V-271580MEDIUMOL 9 audit system must take appropriate action when the audit storage volume is full.V-271581MEDIUMOL 9 audit system must take appropriate action when the audit files have reached maximum size.V-271582MEDIUMOL 9 must periodically flush audit records to disk to prevent the loss of audit records.V-271583MEDIUMOL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.V-271584MEDIUMOL 9 audit log directory must be owned by root to prevent unauthorized read access.V-271585MEDIUMOL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.V-271586MEDIUMOL 9 audit system must audit local events.V-271587MEDIUMOL 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.V-271588MEDIUMOL 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.V-271589MEDIUMOL 9 must forward mail from postmaster to the root account using a postfix alias.V-271590MEDIUMOL 9 must take appropriate action when a critical audit processing failure occurs.V-271591MEDIUMThe OL 9 system administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.V-271592LOWOL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.V-271593MEDIUMOL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.V-271594MEDIUMOL 9 must be configured so that successful/unsuccessful uses of the umount system call generate an audit record.V-271595MEDIUMOL 9 must be configured so that successful/unsuccessful uses of the umount2 system call generate an audit record.V-271596MEDIUMOL 9 must allocate audit record storage capacity to store at least one week's worth of audit records.V-271597MEDIUMOL 9 must be configured to offload audit records onto a different system from the system being audited via syslog.V-271598MEDIUMOL 9 must take appropriate action when the internal event queue is full.V-271599MEDIUMOL 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.V-271600MEDIUMOL 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent utilization.V-271601MEDIUMOL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.V-271602MEDIUMOL 9 must write audit records to disk.V-271603MEDIUMOL 9 must act when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.V-271604MEDIUMOL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.V-271605MEDIUMOL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key.V-271606MEDIUMOL 9 must map the authenticated identity to the user or group account for PKI-based authentication.V-271607MEDIUMOL 9 must enable certificate-based smart card authentication.V-271608MEDIUMOL 9 must implement certificate status checking for multifactor authentication (MFA).V-271609MEDIUMOL 9 must prohibit the use of cached authenticators after one day.V-271610MEDIUMOL 9 must use the CAC smart card driver.V-271611MEDIUMOL 9 must ensure the password complexity module is enabled in the system-auth file.V-271612MEDIUMOL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.V-271613MEDIUMOL 9 must enforce password complexity by requiring that at least one uppercase character be used.V-271614MEDIUMOL 9 must ensure the password complexity module is enabled in the password-auth file.V-271615MEDIUMOL 9 must enforce password complexity by requiring that at least one lowercase character be used.V-271616MEDIUMOL 9 must enforce password complexity by requiring that at least one numeric character be used.V-271617MEDIUMOL 9 must require the change of at least eight characters when passwords are changed.V-271618MEDIUMOL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.V-271619MEDIUMOL 9 must require the maximum number of repeating characters be limited to three when passwords are changed.V-271620MEDIUMOL 9 must require the change of at least four character classes when passwords are changed.V-271621MEDIUMOL 9 must enforce password complexity rules for the root account.V-271622MEDIUMOL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.V-271623MEDIUMOL 9 must be configured to use the shadow file to store only encrypted representations of passwords.V-271624MEDIUMOL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.V-271625MEDIUMOL 9 password-auth must be configured to use a sufficient number of hashing rounds.V-271626MEDIUMOL 9 system-auth must be configured to use a sufficient number of hashing rounds.V-271627MEDIUMOL 9 shadow password suite must be configured to use a sufficient number of hashing rounds.V-271628MEDIUMOL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.V-271629MEDIUMOL 9 passwords for new users or password changes must have a 24-hour minimum password lifetime restriction in /etc/login.defs.V-271630MEDIUMOL 9 passwords must have a 24-hour minimum password lifetime restriction in /etc/shadow.V-271631MEDIUMOL 9 user account passwords for new users or password changes must have a 180-day maximum password lifetime restriction in /etc/login.defs.V-271632MEDIUMOL 9 user account passwords must have a 180-day maximum password lifetime restriction.V-271633MEDIUMOL 9 passwords must be created with a minimum of 15 characters.V-271634HIGHOL 9 must not allow blank or null passwords.V-271635MEDIUMOL 9 must require authentication upon booting into single-user and maintenance modes.V-271636MEDIUMOL 9 must enforce password complexity by requiring that at least one special character be used.V-271637MEDIUMOL 9 must prevent the use of dictionary words for passwords.V-271638MEDIUMOL 9 must not have accounts configured with blank or null passwords.V-271639MEDIUMThe OL 9 file system automounter must be disabled.V-271641MEDIUMOL 9 must prevent special devices on file systems that are imported via Network File System (NFS).V-271642MEDIUMOL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS).V-271643MEDIUMOL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS).V-271644MEDIUMOL 9 must prevent code from being executed on file systems that are used with removable media.V-271645MEDIUMOL 9 must prevent special devices on file systems that are used with removable media.V-271646MEDIUMOL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.V-271647MEDIUMOL 9 must mount /boot with the nodev option.V-271648MEDIUMOL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.V-271649MEDIUMOL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.V-271650MEDIUMOL 9 must mount /dev/shm with the nodev option.V-271651MEDIUMOL 9 must mount /dev/shm with the noexec option.V-271652MEDIUMOL 9 must mount /dev/shm with the nosuid option.V-271653MEDIUMOL 9 must mount /tmp with the nodev option.V-271654MEDIUMOL 9 must mount /tmp with the noexec option.V-271655MEDIUMOL 9 must mount /tmp with the nosuid option.V-271656MEDIUMOL 9 must mount /var with the nodev option.V-271657MEDIUMOL 9 must mount /var/log with the nodev option.V-271658MEDIUMOL 9 must mount /var/log with the noexec option.V-271659MEDIUMOL 9 must mount /var/log with the nosuid option.V-271660MEDIUMOL 9 must mount /var/log/audit with the nodev option.V-271661MEDIUMOL 9 must mount /var/log/audit with the noexec option.V-271662MEDIUMOL 9 must mount /var/log/audit with the nosuid option.V-271663MEDIUMOL 9 must mount /var/tmp with the nodev option.V-271664MEDIUMOL 9 must mount /var/tmp with the noexec option.V-271665MEDIUMOL 9 must mount /var/tmp with the nosuid option.V-271666MEDIUMOL 9 must prevent device files from being interpreted on file systems that contain user home directories.V-271667MEDIUMOL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.V-271668MEDIUMOL 9 must prevent code from being executed on file systems that contain user home directories.V-271669MEDIUMOL 9 must prevent special devices on nonroot local partitions.V-271670MEDIUMOL 9 must disable the graphical user interface automount function unless required.V-271671MEDIUMOL 9 must disable the graphical user interface autorun function unless required.V-271672MEDIUMOL 9 must disable the user list at logon for graphical user interfaces.V-271673MEDIUMOL 9 must initiate a session lock for graphical user interfaces when the screensaver is activated.V-271674MEDIUMOL 9 must automatically lock graphical user sessions after 10 minutes of inactivity.V-271676MEDIUMOL 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.V-271677MEDIUMOL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.V-271678MEDIUMOL 9 must prevent a user from overriding the disabling of the graphical user interface automount function.V-271679MEDIUMOL 9 must prevent a user from overriding the disabling of the graphical user interface autorun function.V-271680MEDIUMOL 9 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.V-271681MEDIUMOL 9 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.V-271682MEDIUMOL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.V-271683MEDIUMOL 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.V-271684MEDIUMOL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.V-271685MEDIUMOL 9 must disable the ability of a user to restart the system from the login screen.V-271686MEDIUMOL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.V-271687MEDIUMOL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.V-271688MEDIUMOL 9 must be configured to enable the display of the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.V-271689MEDIUMOL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.V-271690MEDIUMOL 9 must be able to directly initiate a session lock for all connection types using smart card when the smart card is removed.V-271691HIGHOL 9 must not allow unattended or automatic logon via the graphical user interface.V-271692MEDIUMOL 9 effective dconf policy must match the policy keyfiles.V-271693MEDIUMOL 9 must define default permissions for the bash shell.V-271694MEDIUMOL 9 must define default permissions for the c shell.V-271695MEDIUMOL 9 must define default permissions for the system default profile.V-271696MEDIUMOL 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.V-271697LOWOL 9 must disable the chrony daemon from acting as a server.V-271698LOWOL 9 must disable network management of the chrony daemon.V-271699MEDIUMOL 9 must securely compare internal information system clocks at least every 24 hours.V-271700LOWOL 9 must enable Linux audit logging for the USBGuard daemon.V-271701MEDIUMOL 9 must block unauthorized peripherals before establishing a connection.V-271703MEDIUMOL 9 must log SSH connection attempts and failures to the server.V-271704MEDIUMOL 9 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.V-271705MEDIUMOL 9 must force a frequent session key renegotiation for SSH connections to the server.V-271706HIGHOL 9 SSHD must not allow blank passwords.V-271707HIGHOL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.V-271708MEDIUMOL 9 must not permit direct logons to the root account using remote access via SSH.V-271709MEDIUMOL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.V-271710MEDIUMOL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.V-271711MEDIUMOL 9 SSH daemon must not allow rhosts authentication.V-271712MEDIUMOL 9 SSH daemon must not allow known hosts authentication.V-271713MEDIUMOL 9 SSH daemon must disable remote X connections for interactive users.V-271714MEDIUMOL 9 SSH daemon must perform strict mode checking of home directory configuration files.V-271715MEDIUMOL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.V-271716MEDIUMOL 9 SSH daemon must prevent remote hosts from connecting to the proxy display.V-271718MEDIUMOL 9 SSH daemon must not allow Kerberos authentication.V-271719MEDIUMOL 9 must not allow a noncertificate trusted host SSH logon to the system.V-271720MEDIUMOL 9 must not allow users to override SSH environment variables.V-271721MEDIUMOL 9 SSHD must accept public key authentication.V-271722MEDIUMOL 9 must require reauthentication when using the "sudo" command.V-271723MEDIUMOL 9 must restrict the use of the su command.V-271724MEDIUMOL 9 must require users to reauthenticate for privilege escalation.V-271725MEDIUMOL 9 must require users to provide a password for privilege escalation.V-271726MEDIUMOL 9 must not be configured to bypass password requirements for privilege escalation.V-271727MEDIUMOL 9 must disable the use of user namespaces.V-271728MEDIUMOL 9 must disable the kernel.core_pattern.V-271729MEDIUMOL 9 must disable core dump backtraces.V-271730MEDIUMOL 9 must disable storing core dumps.V-271731MEDIUMOL 9 must disable core dumps for all users.V-271732MEDIUMOL 9 must disable acquiring, saving, and processing core dumps.V-271733MEDIUMOL 9 must be configured so that the kdump service is disabled.V-271734MEDIUMOL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.V-271735LOWOL 9 must enable mitigations against processor-based vulnerabilities.V-271736MEDIUMOL 9 must disable the ability of systemd to spawn an interactive boot process.V-271737MEDIUMOL 9 must disable virtual system calls.V-271738MEDIUMOL 9 must clear the page allocator to prevent use-after-free attacks.V-271739MEDIUMOL 9 systemd-journald service must be enabled.V-271740MEDIUMOL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.V-271741MEDIUMOL 9 must enable kernel parameters to enforce discretionary access control on symlinks.V-271742MEDIUMOL 9 debug-shell systemd service must be disabled.V-271743HIGHOL 9 IP tunnels must use 140-3 approved cryptographic algorithms.V-271744MEDIUMOL 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.V-271745MEDIUMOL 9 must restrict access to the kernel message buffer.V-271746MEDIUMOL 9 must prevent kernel profiling by nonprivileged users.V-271747MEDIUMOL 9 must restrict exposed kernel pointer addresses access.V-271748MEDIUMOL 9 must disable access to network bpf system call from nonprivileged processes.V-271749MEDIUMOL 9 must restrict usage of ptrace to descendant processes.V-271750MEDIUMOL 9 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.V-271751HIGHOL 9 must be configured so that the systemd Ctrl-Alt-Delete burst key sequence is disabled.V-271752HIGHOL 9 must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled.V-271753LOWOL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.V-271754MEDIUMOL 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.V-271755MEDIUMOL 9 must maintain an account lock until the locked account is released by an administrator.V-271756HIGHOL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.V-271757HIGHOL 9 file systems must not contain shosts.equiv files.V-271758HIGHOL 9 file systems must not contain .shosts files.V-271759HIGHOL 9 must implement DoW-approved encryption in the bind package.V-271760MEDIUMOL 9 must implement nonexecutable data to protect its memory from unauthorized code execution.V-271761MEDIUMOL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.V-271763MEDIUMOL 9 must be configured to prevent unrestricted mail relaying.V-271764MEDIUMOL 9 Trivial File Transfer Protocol (TFTP) daemon must be configured to operate in secure mode if the TFTP server is required.V-271766MEDIUMOL 9 must prevent the loading of a new kernel for later execution.V-271768MEDIUMOL 9 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time compiler.V-271769MEDIUMOL 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.V-271770MEDIUMOL 9 must not have unauthorized accounts.V-271771MEDIUMOL 9 SSH private host key files must have mode 0600 or less permissive.V-271772MEDIUMOL 9 SSH public host key files must have mode 0644 or less permissive.V-271773MEDIUMOL 9 system commands must be group-owned by root or a system account.V-271774MEDIUMOL 9 system commands must be owned by root.V-271775MEDIUMOL 9 system commands must have mode 755 or less permissive.V-271776MEDIUMOL 9 SSH server configuration file must be group-owned by root.V-271777MEDIUMOL 9 SSH server configuration file must be owned by root.V-271778MEDIUMOL 9 SSH server configuration file must have mode 0600 or less permissive.V-271779MEDIUMOL 9 must be configured so that a sticky bit must be set on all public directories.V-271780MEDIUMOL 9 local files and directories must have a valid group owner.V-271781MEDIUMOL 9 local files and directories must have a valid owner.V-271782MEDIUMOL 9 local initialization files must have mode 0740 or less permissive.V-271783MEDIUMOL 9 local interactive user home directories must be group-owned by the home directory owner's primary group.V-271784MEDIUMOL 9 local interactive user home directories must have mode 0750 or less permissive.V-271785MEDIUMOL 9 world-writable directories must be owned by root, sys, bin, or an application user.V-271786MEDIUMOL 9 library directories must be group-owned by root or a system account.V-271787MEDIUMOL 9 library directories must be owned by root.V-271788MEDIUMOL 9 library directories must have mode 755 or less permissive.V-271789MEDIUMOL 9 library files must be group owned by root or a system account.V-271790MEDIUMOL 9 library files must be owned by root.V-271791MEDIUMOL 9 library files must have mode 0755 or less permissive.V-271792MEDIUMOL 9 /boot/grub2/grub.cfg file must be group-owned by root.V-271793MEDIUMOL 9 /boot/grub2/grub.cfg file must be owned by root.V-271794MEDIUMOL 9 /etc/group file must be group-owned by root.V-271795MEDIUMOL 9 /etc/group- file must be group-owned by root.V-271796MEDIUMOL 9 /etc/group file must be owned by root.V-271797MEDIUMOL 9 /etc/group- file must be owned by root.V-271798MEDIUMOL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.V-271799MEDIUMOL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.V-271800MEDIUMOL 9 /etc/gshadow file must be group-owned by root.V-271801MEDIUMOL 9 /etc/gshadow- file must be group-owned by root.V-271802MEDIUMOL 9 /etc/gshadow file must be owned by root.V-271803MEDIUMOL 9 /etc/gshadow- file must be owned by root.V-271804MEDIUMOL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.V-271805MEDIUMOL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.V-271806MEDIUMOL 9 /etc/passwd file must be group-owned by root.V-271807MEDIUMOL 9 /etc/passwd- file must be group-owned by root.V-271808MEDIUMOL 9 /etc/passwd file must be owned by root.V-271809MEDIUMOL 9 /etc/passwd- file must be owned by root.V-271810MEDIUMOL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.V-271811MEDIUMOL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.V-271812MEDIUMOL 9 /etc/shadow file must be group-owned by root.V-271813MEDIUMOL 9 /etc/shadow- file must be group-owned by root.V-271814MEDIUMOL 9 /etc/shadow file must be owned by root.V-271815MEDIUMOL 9 /etc/shadow- file must be owned by root.V-271816MEDIUMOL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.V-271817MEDIUMOL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.V-271818MEDIUMOL 9 /var/log directory must be group-owned by root.V-271819MEDIUMOL 9 /var/log directory must be owned by root.V-271820MEDIUMOL 9 /var/log directory must have mode 0755 or less permissive.V-271821MEDIUMOL 9 /var/log/messages file must be group-owned by root.V-271822MEDIUMOL 9 /var/log/messages file must be owned by root.V-271823MEDIUMOL 9 /var/log/messages file must have mode 0640 or less permissive.V-271824MEDIUMOL 9 audit tools must be group-owned by root.V-271825MEDIUMOL 9 audit tools must be owned by root.V-271826MEDIUMOL 9 audit tools must have a mode of 0755 or less permissive.V-271827MEDIUMOL 9 cron configuration directories must have a mode of 0700 or less permissive.V-271828MEDIUMOL 9 cron configuration files directory must be group-owned by root.V-271829MEDIUMOL 9 cron configuration files directory must be owned by root.V-271830MEDIUMOL 9 /etc/crontab file must have mode 0600.V-271831HIGHOL 9 must be configured so that the root account is the only account having unrestricted access to the system.V-271832MEDIUMOL 9 duplicate User IDs (UIDs) must not exist for interactive users.V-271833MEDIUMOL 9 local interactive users must have a home directory assigned in the /etc/passwd file.V-271834MEDIUMOL 9 interactive users must have a primary group that exists.V-271835MEDIUMOL 9 groups must have unique Group ID (GID).V-271836MEDIUMOL 9 must configure SELinux context type to allow the use of a nondefault faillock tally directory.V-271837MEDIUMOL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.V-271838MEDIUMOL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.V-271839MEDIUMOL 9 must automatically lock an account when three unsuccessful logon attempts occur.V-271840MEDIUMOL 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.V-271841MEDIUMOL 9 must log username information when unsuccessful logon attempts occur.V-271842MEDIUMOL 9 must ensure account lockouts persist.V-271843MEDIUMOL 9 must automatically expire temporary accounts within 72 hours.V-271844MEDIUMOL 9 local interactive user home directories defined in the /etc/passwd file must exist.V-271845MEDIUMOL 9 system accounts must not have an interactive login shell.V-271846MEDIUMOL 9 local interactive user accounts must be assigned a home directory upon creation.V-271847MEDIUMOL 9 must be configured so that executable search paths within the initialization files of all local interactive users must only contain paths that resolve to the system default or the users home directory.V-271848MEDIUMOL 9 must set the umask value to 077 for all local interactive user accounts.V-271849MEDIUMOL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.V-271850MEDIUMOL 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.V-271851MEDIUMOL 9 remote access methods must be monitored.V-271852MEDIUMOL 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.V-271853MEDIUMOL 9 must use cron logging.V-271854MEDIUMOL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.V-271855MEDIUMOL 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.V-271856MEDIUMOL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.V-271857MEDIUMOL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.V-271858MEDIUMOL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.V-271859MEDIUMOL 9 wireless network adapters must be disabled.V-271860MEDIUMOL 9 must configure a DNS processing mode set be Network Manager.V-271861MEDIUMOL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured.V-271862MEDIUMOL 9 network interfaces must not be in promiscuous mode.V-271863MEDIUMOL 9 must not have unauthorized IP tunnels configured.V-271864MEDIUMOL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.V-271865MEDIUMOL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets.V-271866MEDIUMOL 9 must log IPv4 packets with impossible addresses.V-271867MEDIUMOL 9 must log IPv4 packets with impossible addresses by default.V-271868MEDIUMOL 9 must use reverse path filtering on all IPv4 interfaces.V-271869MEDIUMOL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.V-271870MEDIUMOL 9 must not forward IPv4 source-routed packets by default.V-271871MEDIUMOL 9 must use a reverse-path filter for IPv4 network traffic, when possible, by default.V-271872MEDIUMOL 9 must not enable IPv4 packet forwarding unless the system is a router.V-271873MEDIUMOL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.V-271874MEDIUMOL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.V-271875MEDIUMOL 9 must not send Internet Control Message Protocol (ICMP) redirects.V-271876MEDIUMOL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.V-271877MEDIUMOL 9 must not accept router advertisements on all IPv6 interfaces.V-271878MEDIUMOL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.V-271879MEDIUMOL 9 must not forward IPv6 source-routed packets.V-271880MEDIUMOL 9 must not enable IPv6 packet forwarding unless the system is a router.V-271881MEDIUMOL 9 must not accept router advertisements on all IPv6 interfaces by default.V-271882MEDIUMOL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.V-271883MEDIUMOL 9 must not forward IPv6 source-routed packets by default.V-271884MEDIUMOL 9 must be configured to use TCP syncookies.V-271885MEDIUMOL 9 audit system must protect logon UIDs from unauthorized change.V-271886MEDIUMOL 9 audit system must protect auditing rules from unauthorized change.V-271901MEDIUMOL 9 must only allow the use of DoW PKI-established certificate authorities (CAs) for authentication in the establishment of protected sessions to OL 9.V-278952MEDIUMOL 9 must audit any script or executable called by cron as root or by any privileged user.V-279935MEDIUMOL 9 must terminate idle user sessions.V-284946MEDIUMOL 9 must elevate the SELinux context when an administrator calls the sudo command.V-288825HIGHOL9 must implement DoW-approved encryption in the OpenSSL package.V-288826MEDIUMOL 9 must audit all uses of the useradd command.