<!DOCTYPE html> <html> <head> <style type="text/css"> /* Style the button that is used to open and close the collapsible content */ .collapsible { background-color: #eee; color: #444; cursor: pointer; padding: 7px; width: 100%; border: none; text-align: left; outline: none; font-size: 15px; } /* Add a background color to the button if it is clicked on (add the .active class with JS), and when you move the mouse over it (hover) */ .active, .collapsible:hover { background-color: #ccc; } /* Style the collapsible content. Note: hidden by default */ .content { padding: 0 18px; display: none; overflow: hidden; background-color: #f1f1f1; } .tooltip { position: relative; display: inline-block; border-bottom: 1px dotted black; } .tooltip .tooltiptext { visibility: hidden; width: 120px; background-color: #555; color: #fff; text-align: center; border-radius: 6px; padding: 5px 0; position: absolute; z-index: 2; bottom: 125%; left: 50%; margin-left: -60px; opacity: 0; transition: opacity 0.3s; } .tooltip .tooltiptext::after { content: ""; position: absolute; top: 100%; left: 50%; margin-left: -5px; border-width: 5px; border-style: solid; border-color: #555 transparent transparent transparent; } .tooltip:hover .tooltiptext { visibility: visible; opacity: 1; } </style> </head> <body> <h2>References for product sle12</h2> <ul> <li class="collapsible">anssi</li> <ul class="content"> <li class="collapsible">BP28(R08)</li> <ul class="content"> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">BP28(R1)</li> <ul class="content"> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> </ul> <li class="collapsible">BP28(R10)</li> <ul class="content"> <li><div class="tooltip">prefer_64bit_os<span class="tooltiptext">Prefer to use a 64-bit Operating System when supported</span></div></li> </ul> <li class="collapsible">BP28(R11)</li> <ul class="content"> <li><div class="tooltip">grub2_enable_iommu_force<span class="tooltiptext">IOMMU configuration directive</span></div></li> </ul> <li class="collapsible">BP28(R12)</li> <ul class="content"> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_srv<span class="tooltiptext">Ensure /srv Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> </ul> <li class="collapsible">BP28(R13)</li> <ul class="content"> <li><div class="tooltip">file_permissions_systemmap<span class="tooltiptext">Verify that local System.map file (if exists) is readable only by root</span></div></li> </ul> <li class="collapsible">BP28(R15)</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">BP28(R17)</li> <ul class="content"> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> </ul> <li class="collapsible">BP28(R18)</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> </ul> <li class="collapsible">BP28(R19)</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">BP28(R22)</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">BP28(R23)</li> <ul class="content"> <li><div class="tooltip">sysctl_fs_protected_hardlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Hardlinks</span></div></li> <li><div class="tooltip">sysctl_fs_protected_symlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Symlinks</span></div></li> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">BP28(R29)</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> </ul> <li class="collapsible">BP28(R32)</li> <ul class="content"> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> </ul> <li class="collapsible">BP28(R35)</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> </ul> <li class="collapsible">BP28(R36)</li> <ul class="content"> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">rsyslog_files_permissions<span class="tooltiptext">Ensure System Log Files Have Correct Permissions</span></div></li> </ul> <li class="collapsible">BP28(R39)</li> <ul class="content"> <li><div class="tooltip">accounts_polyinstantiated_tmp<span class="tooltiptext">Configure Polyinstantiation of /tmp Directories</span></div></li> <li><div class="tooltip">accounts_polyinstantiated_var_tmp<span class="tooltiptext">Configure Polyinstantiation of /var/tmp Directories</span></div></li> </ul> <li class="collapsible">BP28(R4)</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> <li class="collapsible">BP28(R40)</li> <ul class="content"> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> </ul> <li class="collapsible">BP28(R43)</li> <ul class="content"> <li><div class="tooltip">chronyd_specify_remote_server<span class="tooltiptext">A remote time server for Chrony is configured</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">package_chrony_installed<span class="tooltiptext">The Chrony package is installed</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> </ul> <li class="collapsible">BP28(R46)</li> <ul class="content"> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">BP28(R47)</li> <ul class="content"> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> </ul> <li class="collapsible">BP28(R49)</li> <ul class="content"> <li><div class="tooltip">postfix_client_configure_mail_alias<span class="tooltiptext">Configure System to Forward All Mail For The Root Account</span></div></li> </ul> <li class="collapsible">BP28(R5)</li> <ul class="content"> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> </ul> <li class="collapsible">BP28(R50)</li> <ul class="content"> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> </ul> <li class="collapsible">BP28(R51)</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">BP28(R58)</li> <ul class="content"> <li><div class="tooltip">sudo_add_noexec<span class="tooltiptext">Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</span></div></li> <li><div class="tooltip">sudo_add_requiretty<span class="tooltiptext">Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</span></div></li> <li><div class="tooltip">sudo_add_use_pty<span class="tooltiptext">Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</span></div></li> </ul> <li class="collapsible">BP28(R59)</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> </ul> <li class="collapsible">BP28(R60)</li> <ul class="content"> <li><div class="tooltip">sudoers_no_root_target<span class="tooltiptext">Don't target root user in the sudoers file</span></div></li> </ul> <li class="collapsible">BP28(R61)</li> <ul class="content"> <li><div class="tooltip">sudoers_no_command_negation<span class="tooltiptext">Don't define allowed commands in sudoers by means of exclusion</span></div></li> </ul> <li class="collapsible">BP28(R63)</li> <ul class="content"> <li><div class="tooltip">sudoers_explicit_command_args<span class="tooltiptext">Explicit arguments in sudo specifications</span></div></li> </ul> <li class="collapsible">BP28(R66)</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> <li class="collapsible">BP28(R7)</li> <ul class="content"> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">NT007(R02)</li> <ul class="content"> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> </ul> <li class="collapsible">NT007(R03)</li> <ul class="content"> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> </ul> <li class="collapsible">NT007(R1)</li> <ul class="content"> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> </ul> <li class="collapsible">NT007(R17)</li> <ul class="content"> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> </ul> <li class="collapsible">NT007(R21)</li> <ul class="content"> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">NT012(R03)</li> <ul class="content"> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> </ul> <li class="collapsible">NT12(R18)</li> <ul class="content"> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> </ul> <li class="collapsible">NT12(R5)</li> <ul class="content"> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">NT28(R43)</li> <ul class="content"> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">NT28(R46)</li> <ul class="content"> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> </ul> </ul> <li class="collapsible">cis</li> <ul class="content"> <li class="collapsible">5.2.4</li> <ul class="content"> <li><div class="tooltip">sshd_disable_x11_forwarding<span class="tooltiptext">Disable X11 Forwarding</span></div></li> </ul> </ul> <li class="collapsible">cis-csc</li> <ul class="content"> <li class="collapsible">1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">11</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">12</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">13</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">14</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">15</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">16</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">18</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">19</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">2</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">20</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> </ul> <li class="collapsible">3</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">5</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">6</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">7</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">8</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">9</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> </ul> <li class="collapsible">cjis</li> <ul class="content"> <li class="collapsible">5.10.1.1</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">5.10.1.3</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">5.10.4.1</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">5.4.1.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">5.5.2</li> <ul class="content"> <li><div class="tooltip">account_unique_name<span class="tooltiptext">Ensure All Accounts on the System Have Unique Names</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> </ul> <li class="collapsible">5.5.2.2</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> </ul> <li class="collapsible">5.5.5</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> </ul> <li class="collapsible">5.5.6</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">5.6.2.1</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> </ul> <li class="collapsible">5.6.2.1.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> </ul> <li class="collapsible">5.6.2.2</li> <ul class="content"> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> </ul> </ul> <li class="collapsible">cobit5</li> <ul class="content"> <li class="collapsible">APO01.06</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">APO07.06</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">APO08.04</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">APO10.01</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">APO10.03</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">APO10.04</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">APO10.05</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">APO11.04</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">APO11.06</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">APO12.01</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">APO12.02</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">APO12.03</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">APO12.04</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">APO12.06</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">APO13.01</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">APO13.02</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">BAI01.06</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">BAI02.01</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">BAI03.01</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">BAI03.02</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">BAI03.03</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">BAI03.05</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">BAI03.08</li> <ul class="content"> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> </ul> <li class="collapsible">BAI03.10</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">BAI04.04</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">BAI06.01</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">BAI07.04</li> <ul class="content"> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> </ul> <li class="collapsible">BAI08.02</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">BAI08.04</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">BAI09.01</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">BAI09.02</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">BAI09.03</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">BAI10.01</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">BAI10.02</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">BAI10.03</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">BAI10.05</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">DSS01.03</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">DSS01.04</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">DSS01.05</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">DSS02.02</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">DSS02.04</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">DSS02.05</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DSS02.07</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">DSS03.01</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">DSS03.04</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DSS03.05</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">DSS04.05</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DSS04.07</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">DSS05.01</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">DSS05.02</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">DSS05.03</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">DSS05.04</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">DSS05.05</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">DSS05.06</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> </ul> <li class="collapsible">DSS05.07</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">DSS05.10</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">DSS06.01</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DSS06.02</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">DSS06.03</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">DSS06.06</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">DSS06.10</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">MEA01.01</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">MEA01.02</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">MEA01.03</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">MEA01.04</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">MEA01.05</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">MEA02.01</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">MEA03.03</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">MEA03.04</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> </ul> <li class="collapsible">cui</li> <ul class="content"> <li class="collapsible">3.1.1</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">3.1.10</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> </ul> <li class="collapsible">3.1.11</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">3.1.12</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">3.1.13</li> <ul class="content"> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">3.1.16</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">3.1.2</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> <li class="collapsible">3.1.20</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">3.1.21</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> </ul> <li class="collapsible">3.1.5</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">3.1.6</li> <ul class="content"> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> </ul> <li class="collapsible">3.1.7</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">3.1.8</li> <ul class="content"> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> </ul> <li class="collapsible">3.1.9</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">3.13.10</li> <ul class="content"> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> </ul> <li class="collapsible">3.13.11</li> <ul class="content"> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">3.13.16</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">3.13.8</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">3.3.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">3.3.2</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">3.3.6</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">3.4.3</li> <ul class="content"> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> </ul> <li class="collapsible">3.4.5</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> </ul> <li class="collapsible">3.4.6</li> <ul class="content"> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">3.4.8</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">3.5.10</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> </ul> <li class="collapsible">3.5.4</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> </ul> <li class="collapsible">3.5.6</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> </ul> <li class="collapsible">3.5.7</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> </ul> <li class="collapsible">3.5.8</li> <ul class="content"> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> </ul> <li class="collapsible">3.7.2</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> </ul> <li class="collapsible">disa</li> <ul class="content"> <li class="collapsible">CCI-000016</li> <ul class="content"> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">CCI-000017</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> </ul> <li class="collapsible">CCI-000018</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-000044</li> <ul class="content"> <li><div class="tooltip">accounts_passwords_pam_tally2<span class="tooltiptext">Set Deny For Failed Password Attempts</span></div></li> </ul> <li class="collapsible">CCI-000048</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">ftp_present_banner<span class="tooltiptext">Create Warning Banners for All FTP Users</span></div></li> <li><div class="tooltip">gui_login_dod_acknowledgement<span class="tooltiptext">Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">CCI-000050</li> <ul class="content"> <li><div class="tooltip">banner_etc_gdm_banner<span class="tooltiptext">Modify the System GUI Login Banner</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">gui_login_dod_acknowledgement<span class="tooltiptext">Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">CCI-000054</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> </ul> <li class="collapsible">CCI-000056</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">vlock_installed<span class="tooltiptext">Check that vlock is installed to allow session locking</span></div></li> </ul> <li class="collapsible">CCI-000057</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> </ul> <li class="collapsible">CCI-000058</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">vlock_installed<span class="tooltiptext">Check that vlock is installed to allow session locking</span></div></li> </ul> <li class="collapsible">CCI-000060</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">vlock_installed<span class="tooltiptext">Check that vlock is installed to allow session locking</span></div></li> </ul> <li class="collapsible">CCI-000067</li> <ul class="content"> <li><div class="tooltip">sshd_set_loglevel_verbose<span class="tooltiptext">Set SSH Daemon LogLevel to VERBOSE</span></div></li> </ul> <li class="collapsible">CCI-000068</li> <ul class="content"> <li><div class="tooltip">sshd_rekey_limit<span class="tooltiptext">Force frequent session key renegotiation</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">CCI-000085</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">CCI-000126</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000130</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000131</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000132</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000133</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000134</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000135</li> <ul class="content"> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000136</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">CCI-000139</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">postfix_client_configure_mail_alias<span class="tooltiptext">Configure System to Forward All Mail For The Root Account</span></div></li> </ul> <li class="collapsible">CCI-000140</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> </ul> <li class="collapsible">CCI-000154</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000158</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000160</li> <ul class="content"> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> </ul> <li class="collapsible">CCI-000162</li> <ul class="content"> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> </ul> <li class="collapsible">CCI-000163</li> <ul class="content"> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> </ul> <li class="collapsible">CCI-000164</li> <ul class="content"> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">permissions_local_var_log_audit<span class="tooltiptext">Verify that Local Logs of the audit Daemon are not World-Readable</span></div></li> </ul> <li class="collapsible">CCI-000169</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-000172</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-000185</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> </ul> <li class="collapsible">CCI-000187</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">CCI-000192</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_ucredit<span class="tooltiptext">Set Password Strength Minimum Uppercase Characters</span></div></li> </ul> <li class="collapsible">CCI-000193</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_lcredit<span class="tooltiptext">Set Password Strength Minimum Lowercase Characters</span></div></li> </ul> <li class="collapsible">CCI-000194</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_dcredit<span class="tooltiptext">Set Password Strength Minimum Digit Characters</span></div></li> </ul> <li class="collapsible">CCI-000195</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_difok<span class="tooltiptext">Set Password Strength Minimum Different Characters</span></div></li> </ul> <li class="collapsible">CCI-000196</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> </ul> <li class="collapsible">CCI-000197</li> <ul class="content"> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> </ul> <li class="collapsible">CCI-000198</li> <ul class="content"> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_set_min_life_existing<span class="tooltiptext">Set Existing Passwords Minimum Age</span></div></li> </ul> <li class="collapsible">CCI-000199</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_password_set_max_life_existing<span class="tooltiptext">Set Existing Passwords Maximum Age</span></div></li> </ul> <li class="collapsible">CCI-000200</li> <ul class="content"> <li><div class="tooltip">accounts_password_pam_pwhistory_remember<span class="tooltiptext">Limit Password Reuse</span></div></li> <li><div class="tooltip">file_etc_security_opasswd<span class="tooltiptext">Verify Permissions and Ownership of Old Passwords File</span></div></li> </ul> <li class="collapsible">CCI-000205</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_minlen<span class="tooltiptext">Set Password Minimum Length</span></div></li> </ul> <li class="collapsible">CCI-000213</li> <ul class="content"> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> </ul> <li class="collapsible">CCI-000225</li> <ul class="content"> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> </ul> <li class="collapsible">CCI-000318</li> <ul class="content"> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> </ul> <li class="collapsible">CCI-000366</li> <ul class="content"> <li><div class="tooltip">accounts_authorized_local_users<span class="tooltiptext">Only Authorized Local User Accounts Exist on Operating System</span></div></li> <li><div class="tooltip">accounts_have_homedir_login_defs<span class="tooltiptext">Ensure Home Directories are Created for New Users</span></div></li> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_passwords_pam_faildelay_delay<span class="tooltiptext">Enforce Delay After Failed Logon Attempts</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">accounts_user_dot_no_world_writable_programs<span class="tooltiptext">User Initialization Files Must Not Run World-Writable Programs</span></div></li> <li><div class="tooltip">accounts_user_home_paths_only<span class="tooltiptext">Ensure that Users Path Contains Only Local Directories</span></div></li> <li><div class="tooltip">accounts_user_interactive_home_directory_defined<span class="tooltiptext">All Interactive Users Must Have A Home Directory Defined</span></div></li> <li><div class="tooltip">accounts_user_interactive_home_directory_exists<span class="tooltiptext">All Interactive Users Home Directories Must Exist</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_enable_syscall_auditing<span class="tooltiptext">Remove Default Configuration to Disable Syscall Auditing</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">auditd_local_events<span class="tooltiptext">Include Local Events in Audit Logs</span></div></li> <li><div class="tooltip">auditd_log_format<span class="tooltiptext">Resolve information before writing to audit logs</span></div></li> <li><div class="tooltip">coredump_disable_backtraces<span class="tooltiptext">Disable core dump backtraces</span></div></li> <li><div class="tooltip">coredump_disable_storage<span class="tooltiptext">Disable storing core dump</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_retry<span class="tooltiptext">Set Password Retry Limit</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupownership_home_directories<span class="tooltiptext">All Interactive User Home Directories Must Be Group-Owned By The Primary User</span></div></li> <li><div class="tooltip">file_permission_user_init_files<span class="tooltiptext">Ensure All User Initialization Files Have Mode 0740 Or Less Permissive</span></div></li> <li><div class="tooltip">file_permissions_home_directories<span class="tooltiptext">All Interactive User Home Directories Must Have mode 0750 Or Less Permissive</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_host_based_files<span class="tooltiptext">Remove Host-Based Authentication Files</span></div></li> <li><div class="tooltip">no_user_host_based_files<span class="tooltiptext">Remove User Host-Based Authentication Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">pam_disable_automatic_configuration<span class="tooltiptext">The PAM configuration should not be changed automatically</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">postfix_client_configure_mail_alias<span class="tooltiptext">Configure System to Forward All Mail For The Root Account</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_disable_x11_forwarding<span class="tooltiptext">Disable X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">CCI-000368</li> <ul class="content"> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> </ul> <li class="collapsible">CCI-000381</li> <ul class="content"> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> </ul> <li class="collapsible">CCI-000382</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> <li><div class="tooltip">service_SuSEfirewall2_enabled<span class="tooltiptext">Enable the SuSEfirewall 2</span></div></li> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">CCI-000764</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> </ul> <li class="collapsible">CCI-000765</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">CCI-000766</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> </ul> <li class="collapsible">CCI-000767</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">CCI-000768</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">CCI-000770</li> <ul class="content"> <li><div class="tooltip">account_unique_name<span class="tooltiptext">Ensure All Accounts on the System Have Unique Names</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">CCI-000778</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">CCI-000795</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> </ul> <li class="collapsible">CCI-000803</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">kerberos_disable_no_keytab<span class="tooltiptext">Disable Kerberos by removing host keytab</span></div></li> <li><div class="tooltip">set_password_hashing_min_rounds_logindefs<span class="tooltiptext">Set Password Hashing Rounds in /etc/login.defs</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">CCI-000804</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> <li><div class="tooltip">account_unique_name<span class="tooltiptext">Ensure All Accounts on the System Have Unique Names</span></div></li> </ul> <li class="collapsible">CCI-000877</li> <ul class="content"> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">CCI-000879</li> <ul class="content"> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">CCI-001090</li> <ul class="content"> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> </ul> <li class="collapsible">CCI-001095</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">CCI-001133</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">CCI-001199</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">CCI-001208</li> <ul class="content"> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> </ul> <li class="collapsible">CCI-001227</li> <ul class="content"> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">CCI-001233</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">CCI-001263</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">CCI-001311</li> <ul class="content"> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">CCI-001312</li> <ul class="content"> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">CCI-001314</li> <ul class="content"> <li><div class="tooltip">file_groupowner_var_log<span class="tooltiptext">Verify Group Who Owns /var/log Directory</span></div></li> <li><div class="tooltip">file_groupowner_var_log_messages<span class="tooltiptext">Verify Group Who Owns /var/log/messages File</span></div></li> <li><div class="tooltip">file_owner_var_log<span class="tooltiptext">Verify User Who Owns /var/log Directory</span></div></li> <li><div class="tooltip">file_owner_var_log_messages<span class="tooltiptext">Verify User Who Owns /var/log/messages File</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_local_var_log_messages<span class="tooltiptext">Verify that local /var/log/messages is not world-readable</span></div></li> <li><div class="tooltip">file_permissions_var_log<span class="tooltiptext">Verify Permissions on /var/log Directory</span></div></li> <li><div class="tooltip">file_permissions_var_log_messages<span class="tooltiptext">Verify Permissions on /var/log/messages File</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_files_permissions<span class="tooltiptext">Ensure System Log Files Have Correct Permissions</span></div></li> </ul> <li class="collapsible">CCI-001343</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">CCI-001348</li> <ul class="content"> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">CCI-001384</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">CCI-001385</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">CCI-001386</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">CCI-001387</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">CCI-001388</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">CCI-001403</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-001404</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-001405</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-001436</li> <ul class="content"> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> </ul> <li class="collapsible">CCI-001444</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">CCI-001453</li> <ul class="content"> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">CCI-001464</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-001487</li> <ul class="content"> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-001493</li> <ul class="content"> <li><div class="tooltip">permissions_local_audit_binaries<span class="tooltiptext">Verify Permissions of Local Logs of audit Tools</span></div></li> </ul> <li class="collapsible">CCI-001494</li> <ul class="content"> <li><div class="tooltip">permissions_local_audit_binaries<span class="tooltiptext">Verify Permissions of Local Logs of audit Tools</span></div></li> </ul> <li class="collapsible">CCI-001495</li> <ul class="content"> <li><div class="tooltip">permissions_local_audit_binaries<span class="tooltiptext">Verify Permissions of Local Logs of audit Tools</span></div></li> </ul> <li class="collapsible">CCI-001496</li> <ul class="content"> <li><div class="tooltip">aide_check_audit_tools<span class="tooltiptext">Configure AIDE to Verify the Audit Tools</span></div></li> </ul> <li class="collapsible">CCI-001499</li> <ul class="content"> <li><div class="tooltip">dir_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Directories Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">run_chkstat<span class="tooltiptext">OS commands and libraries must have the proper permissions to protect from unauthorized access</span></div></li> </ul> <li class="collapsible">CCI-001503</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">CCI-001551</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> </ul> <li class="collapsible">CCI-001557</li> <ul class="content"> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">CCI-001619</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_ocredit<span class="tooltiptext">Set Password Strength Minimum Special Characters</span></div></li> </ul> <li class="collapsible">CCI-001682</li> <ul class="content"> <li><div class="tooltip">account_emergency_admin<span class="tooltiptext">Never Automatically Remove or Disable Emergency Administrator Accounts</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">CCI-001683</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-001684</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-001685</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-001686</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-001744</li> <ul class="content"> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">CCI-001749</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">CCI-001764</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> </ul> <li class="collapsible">CCI-001812</li> <ul class="content"> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> </ul> <li class="collapsible">CCI-001813</li> <ul class="content"> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> </ul> <li class="collapsible">CCI-001814</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> </ul> <li class="collapsible">CCI-001849</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_sufficiently_large_partition<span class="tooltiptext">Configure a Sufficiently Large Partition for Audit Logs</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> </ul> <li class="collapsible">CCI-001851</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> <li><div class="tooltip">auditd_audispd_encrypt_sent_records<span class="tooltiptext">Encrypt Audit Records Sent With audispd Plugin</span></div></li> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> <li><div class="tooltip">auditd_name_format<span class="tooltiptext">Set hostname as computer node name in audit logs</span></div></li> <li><div class="tooltip">package_audit-audispd-plugins_installed<span class="tooltiptext">Ensure the default plugins for the audit dispatcher are Installed</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">CCI-001855</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">CCI-001875</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001876</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-001877</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001878</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001879</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001880</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001881</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001882</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001889</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001890</li> <ul class="content"> <li><div class="tooltip">ensure_rtc_utc_configuration<span class="tooltiptext">Ensure real-time clock is set to UTC</span></div></li> </ul> <li class="collapsible">CCI-001891</li> <ul class="content"> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> </ul> <li class="collapsible">CCI-001914</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CCI-001948</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">smartcard_configure_cert_checking<span class="tooltiptext">Configure Smart Card Certificate Status Checking</span></div></li> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">CCI-001953</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">smartcard_configure_cert_checking<span class="tooltiptext">Configure Smart Card Certificate Status Checking</span></div></li> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">CCI-001954</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">smartcard_configure_cert_checking<span class="tooltiptext">Configure Smart Card Certificate Status Checking</span></div></li> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">CCI-001958</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">CCI-001991</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> </ul> <li class="collapsible">CCI-002007</li> <ul class="content"> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> </ul> <li class="collapsible">CCI-002038</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">CCI-002041</li> <ul class="content"> <li><div class="tooltip">policy_temp_passwords_immediate_change<span class="tooltiptext">Policy Requires Immediate Change of Temporary Passwords</span></div></li> </ul> <li class="collapsible">CCI-002046</li> <ul class="content"> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> </ul> <li class="collapsible">CCI-002080</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> </ul> <li class="collapsible">CCI-002130</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-002132</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">CCI-002165</li> <ul class="content"> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">sysctl_fs_protected_hardlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Hardlinks</span></div></li> <li><div class="tooltip">sysctl_fs_protected_symlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Symlinks</span></div></li> </ul> <li class="collapsible">CCI-002234</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> </ul> <li class="collapsible">CCI-002314</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> </ul> <li class="collapsible">CCI-002361</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">CCI-002385</li> <ul class="content"> <li><div class="tooltip">susefirewall2_ddos_protection<span class="tooltiptext">Enable DoS Protections in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">CCI-002418</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_openssh_installed<span class="tooltiptext">Install the OpenSSH Client and Server Package</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">CCI-002420</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_openssh_installed<span class="tooltiptext">Install the OpenSSH Client and Server Package</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">CCI-002421</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_openssh_installed<span class="tooltiptext">Install the OpenSSH Client and Server Package</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">CCI-002422</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_openssh_installed<span class="tooltiptext">Install the OpenSSH Client and Server Package</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">CCI-002450</li> <ul class="content"> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> </ul> <li class="collapsible">CCI-002475</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">CCI-002476</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">CCI-002617</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> </ul> <li class="collapsible">CCI-002696</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> <li class="collapsible">CCI-002699</li> <ul class="content"> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">CCI-002702</li> <ul class="content"> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> </ul> <li class="collapsible">CCI-002824</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">CCI-002884</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">CCI-002890</li> <ul class="content"> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">CCI-003123</li> <ul class="content"> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> </ul> <li class="collapsible">hipaa</li> <ul class="content"> <li class="collapsible">164.308(a)(1)(ii)(B)</li> <ul class="content"> <li><div class="tooltip">dconf_db_up_to_date<span class="tooltiptext">Make sure that the dconf databases are up-to-date with regards to respective keyfiles</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> </ul> <li class="collapsible">164.308(a)(1)(ii)(D)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">164.308(a)(3)</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">164.308(a)(3)(i)</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">164.308(a)(3)(ii)(A)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">164.308(a)(4)</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">164.308(a)(4)(i)</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">164.308(a)(5)(ii)(A)</li> <ul class="content"> <li><div class="tooltip">dconf_db_up_to_date<span class="tooltiptext">Make sure that the dconf databases are up-to-date with regards to respective keyfiles</span></div></li> </ul> <li class="collapsible">164.308(a)(5)(ii)(B)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">164.308(a)(5)(ii)(C)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">164.308(a)(6)(ii)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">164.308(a)(7)(i)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> </ul> <li class="collapsible">164.308(a)(7)(ii)(A)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> </ul> <li class="collapsible">164.308(a)(8)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">164.308(b)(1)</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">164.308(b)(2)</li> <ul class="content"> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">164.308(b)(3)</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">164.310(a)(1)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> </ul> <li class="collapsible">164.310(a)(2)(i)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> </ul> <li class="collapsible">164.310(a)(2)(ii)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> </ul> <li class="collapsible">164.310(a)(2)(iii)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> </ul> <li class="collapsible">164.310(a)(2)(iv)</li> <ul class="content"> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">164.310(b)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">164.310(c)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">164.310(d)</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">164.310(d)(1)</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">164.310(d)(2)</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">164.310(d)(2)(iii)</li> <ul class="content"> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">164.312(a)</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">164.312(a)(1)</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">164.312(a)(2)(i)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">164.312(a)(2)(ii)</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> </ul> <li class="collapsible">164.312(a)(2)(iii)</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">164.312(a)(2)(iv)</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">164.312(b)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">164.312(c)</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">164.312(c)(1)</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">164.312(c)(2)</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">164.312(d)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">164.312(e)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">164.312(e)(1)</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">164.312(e)(2)(i)</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">164.312(e)(2)(ii)</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">164.314(a)(2)(i)(C)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">164.314(a)(2)(iii)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">164.314(b)(2)(i)</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> </ul> <li class="collapsible">isa-62443-2009</li> <ul class="content"> <li class="collapsible">4.2.3</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">4.2.3.10</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">4.2.3.12</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">4.2.3.4</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">4.2.3.7</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">4.2.3.9</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">4.3.2.6.7</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">4.3.3.2.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> </ul> <li class="collapsible">4.3.3.3.7</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">4.3.3.3.9</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">4.3.3.4</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">4.3.3.5.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.5.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.5.3</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.5.4</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.5.5</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.5.6</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.5.7</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.5.8</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.6.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.6.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.6.3</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.6.4</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.6.5</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.6.6</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">4.3.3.6.7</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.6.8</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.6.9</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.7.1</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.7.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.7.3</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.3.7.4</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.4.3.2</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.4.3.3</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">4.3.4.4.4</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">4.3.4.4.7</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">4.3.4.5.2</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">4.3.4.5.5</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> </ul> <li class="collapsible">4.3.4.5.6</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">4.3.4.5.7</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">4.3.4.5.8</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">4.3.4.5.9</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">4.4.2.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">4.4.2.2</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">4.4.2.4</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">4.4.3.2</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">4.4.3.3</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">4.4.3.4</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> </ul> <li class="collapsible">isa-62443-2013</li> <ul class="content"> <li class="collapsible">SR 1.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.10</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.11</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.12</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.13</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 1.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.3</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.4</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.5</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.6</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.7</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.8</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 1.9</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 2.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 2.10</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SR 2.11</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SR 2.12</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SR 2.2</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 2.3</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 2.4</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 2.5</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 2.6</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 2.7</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SR 2.8</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SR 2.9</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SR 3.1</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 3.3</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">SR 3.4</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">SR 3.5</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 3.8</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 3.9</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">SR 4.1</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 4.2</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SR 4.3</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 5.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 5.2</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 5.3</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 6.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">SR 6.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SR 7.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 7.2</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SR 7.6</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SR 7.8</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> </ul> <li class="collapsible">ism</li> <ul class="content"> <li class="collapsible">0418</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">kerberos_disable_no_keytab<span class="tooltiptext">Disable Kerberos by removing host keytab</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> </ul> <li class="collapsible">0421</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">0422</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">0431</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">0487</li> <ul class="content"> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> </ul> <li class="collapsible">0582</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">0584</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">0586</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">05885</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">0846</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">0957</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">0974</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">0988</li> <ul class="content"> <li><div class="tooltip">chronyd_specify_remote_server<span class="tooltiptext">A remote time server for Chrony is configured</span></div></li> <li><div class="tooltip">package_chrony_installed<span class="tooltiptext">The Chrony package is installed</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_files_permissions<span class="tooltiptext">Ensure System Log Files Have Correct Permissions</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_chronyd_enabled<span class="tooltiptext">The Chronyd service is enabled</span></div></li> </ul> <li class="collapsible">1034</li> <ul class="content"> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">1055</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">kerberos_disable_no_keytab<span class="tooltiptext">Disable Kerberos by removing host keytab</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> </ul> <li class="collapsible">1173</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1288</li> <ul class="content"> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">1315</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">1319</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">1341</li> <ul class="content"> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">1401</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1402</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">kerberos_disable_no_keytab<span class="tooltiptext">Disable Kerberos by removing host keytab</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> </ul> <li class="collapsible">1405</li> <ul class="content"> <li><div class="tooltip">chronyd_specify_remote_server<span class="tooltiptext">A remote time server for Chrony is configured</span></div></li> <li><div class="tooltip">package_chrony_installed<span class="tooltiptext">The Chrony package is installed</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_files_permissions<span class="tooltiptext">Ensure System Log Files Have Correct Permissions</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_chronyd_enabled<span class="tooltiptext">The Chronyd service is enabled</span></div></li> </ul> <li class="collapsible">1410</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> </ul> <li class="collapsible">1417</li> <ul class="content"> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">1449</li> <ul class="content"> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> </ul> <li class="collapsible">1504</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1505</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1506</li> <ul class="content"> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> </ul> <li class="collapsible">1546</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1557</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1558</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1559</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1560</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> <li class="collapsible">1561</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_set_max_auth_tries<span class="tooltiptext">Set SSH authentication attempt limit</span></div></li> </ul> </ul> <li class="collapsible">iso27001-2013</li> <ul class="content"> <li class="collapsible">A.10.1.1</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.11.1.2</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">A.11.1.4</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.11.1.5</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.11.2.1</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.11.2.4</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">A.11.2.5</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">A.11.2.6</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">A.11.2.9</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> </ul> <li class="collapsible">A.12.1.1</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.12.1.2</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">A.12.1.3</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">A.12.1.4</li> <ul class="content"> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> </ul> <li class="collapsible">A.12.2.1</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">A.12.4.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">A.12.4.2</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">A.12.4.3</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">A.12.4.4</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">A.12.5.1</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">A.12.6.1</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">A.12.6.2</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">A.12.7.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">A.13.1.1</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">A.13.1.2</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.13.1.3</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.13.2.1</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">A.13.2.2</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.13.2.3</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.13.2.4</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.14.1.1</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">A.14.1.2</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.14.1.3</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">A.14.2.1</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">A.14.2.2</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">A.14.2.3</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">A.14.2.4</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">A.14.2.5</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">A.14.2.7</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">A.14.2.8</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">A.15.1.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> </ul> <li class="collapsible">A.15.2.1</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">A.15.2.2</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">A.16.1.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">A.16.1.2</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">A.16.1.3</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">A.16.1.4</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">A.16.1.5</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">A.16.1.6</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">A.16.1.7</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">A.17.2.1</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">A.18.1.4</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">A.18.2.2</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">A.18.2.3</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">A.6.1.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.6.1.3</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> </ul> <li class="collapsible">A.6.1.5</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">A.6.2.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">A.6.2.2</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">A.7.1.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.7.1.2</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.7.3.1</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.8.1.1</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">A.8.1.2</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">A.8.2.1</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> </ul> <li class="collapsible">A.8.2.2</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.8.2.3</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.8.3.1</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> </ul> <li class="collapsible">A.8.3.3</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> </ul> <li class="collapsible">A.9.1.1</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.9.1.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">A.9.2.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">A.9.2.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">A.9.2.3</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.9.2.4</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">A.9.2.6</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">A.9.3.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">A.9.4.1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.9.4.2</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">A.9.4.3</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">A.9.4.4</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">A.9.4.5</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">Clause 16.1.2</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">Clause 7.4</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> </ul> <li class="collapsible">nist</li> <ul class="content"> <li class="collapsible"></li> <ul class="content"> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">AC-10</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> </ul> <li class="collapsible">AC-11</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> </ul> <li class="collapsible">AC-11(1)</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">vlock_installed<span class="tooltiptext">Check that vlock is installed to allow session locking</span></div></li> </ul> <li class="collapsible">AC-11(1).1</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> </ul> <li class="collapsible">AC-11(a)</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">vlock_installed<span class="tooltiptext">Check that vlock is installed to allow session locking</span></div></li> </ul> <li class="collapsible">AC-11(b)</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">vlock_installed<span class="tooltiptext">Check that vlock is installed to allow session locking</span></div></li> </ul> <li class="collapsible">AC-11.1 (ii)</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> </ul> <li class="collapsible">AC-11.1(iii)</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> </ul> <li class="collapsible">AC-12</li> <ul class="content"> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">AC-17(1)</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> <li><div class="tooltip">service_SuSEfirewall2_enabled<span class="tooltiptext">Enable the SuSEfirewall 2</span></div></li> <li><div class="tooltip">sshd_set_loglevel_verbose<span class="tooltiptext">Set SSH Daemon LogLevel to VERBOSE</span></div></li> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">AC-17(2)</li> <ul class="content"> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">AC-17(a)</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_set_loglevel_info<span class="tooltiptext">Set LogLevel to INFO</span></div></li> <li><div class="tooltip">sshd_set_loglevel_verbose<span class="tooltiptext">Set SSH Daemon LogLevel to VERBOSE</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">AC-18(1)</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">AC-2(2)</li> <ul class="content"> <li><div class="tooltip">account_emergency_admin<span class="tooltiptext">Never Automatically Remove or Disable Emergency Administrator Accounts</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">AC-2(2).1(ii)</li> <ul class="content"> <li><div class="tooltip">account_emergency_admin<span class="tooltiptext">Never Automatically Remove or Disable Emergency Administrator Accounts</span></div></li> </ul> <li class="collapsible">AC-2(3)</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">AC-2(4)</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">AC-2(5)</li> <ul class="content"> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">AC-2(7)(b)</li> <ul class="content"> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> </ul> <li class="collapsible">AC-3</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> </ul> <li class="collapsible">AC-3(3)(a)</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> <li class="collapsible">AC-4</li> <ul class="content"> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> </ul> <li class="collapsible">AC-6</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_password_auth_for_systemaccounts<span class="tooltiptext">Ensure that System Accounts Are Locked</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">AC-6(1)</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_files_permissions<span class="tooltiptext">Ensure System Log Files Have Correct Permissions</span></div></li> <li><div class="tooltip">sysctl_fs_protected_hardlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Hardlinks</span></div></li> <li><div class="tooltip">sysctl_fs_protected_symlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Symlinks</span></div></li> </ul> <li class="collapsible">AC-6(10)</li> <ul class="content"> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> </ul> <li class="collapsible">AC-6(2)</li> <ul class="content"> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">AC-6(8)</li> <ul class="content"> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> </ul> <li class="collapsible">AC-6(9)</li> <ul class="content"> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">directory_access_var_log_audit<span class="tooltiptext">Record Access Events to Audit Log Directory</span></div></li> </ul> <li class="collapsible">AC-7(a)</li> <ul class="content"> <li><div class="tooltip">accounts_passwords_pam_tally2<span class="tooltiptext">Set Deny For Failed Password Attempts</span></div></li> </ul> <li class="collapsible">AC-7(b)</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> </ul> <li class="collapsible">AC-8 a</li> <ul class="content"> <li><div class="tooltip">gui_login_dod_acknowledgement<span class="tooltiptext">Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement</span></div></li> </ul> <li class="collapsible">AC-8 b</li> <ul class="content"> <li><div class="tooltip">gui_login_dod_acknowledgement<span class="tooltiptext">Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement</span></div></li> </ul> <li class="collapsible">AC-8(a)</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">AC-8(b)</li> <ul class="content"> <li><div class="tooltip">banner_etc_gdm_banner<span class="tooltiptext">Modify the System GUI Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> </ul> <li class="collapsible">AC-8(c)</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">AC-8.1 (ii)</li> <ul class="content"> <li><div class="tooltip">gui_login_dod_acknowledgement<span class="tooltiptext">Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement</span></div></li> </ul> <li class="collapsible">AC-8.1 (iii)</li> <ul class="content"> <li><div class="tooltip">gui_login_dod_acknowledgement<span class="tooltiptext">Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement</span></div></li> </ul> <li class="collapsible">AC-8.1(ii)</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> </ul> <li class="collapsible">AC-9</li> <ul class="content"> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> </ul> <li class="collapsible">AC-9(1)</li> <ul class="content"> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">AU-11</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> </ul> <li class="collapsible">AU-12(3)</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">AU-12(a)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> </ul> <li class="collapsible">AU-12(c)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">directory_access_var_log_audit<span class="tooltiptext">Record Access Events to Audit Log Directory</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">AU-12.1(a)</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> </ul> <li class="collapsible">AU-12.1(ii)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> </ul> <li class="collapsible">AU-12.1(iv)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">AU-12.1(iv)AU-12(c)</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> </ul> <li class="collapsible">AU-14(1)</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-14(1).1</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-2(d)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">directory_access_var_log_audit<span class="tooltiptext">Record Access Events to Audit Log Directory</span></div></li> </ul> <li class="collapsible">AU-3</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-3(1)</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-3(1).1(ii)</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-3.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-4</li> <ul class="content"> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> </ul> <li class="collapsible">AU-4(1)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">package_audit-audispd-plugins_installed<span class="tooltiptext">Ensure the default plugins for the audit dispatcher are Installed</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">AU-5(1)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">AU-5(2)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">AU-5(4)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">AU-5(a)</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">postfix_client_configure_mail_alias<span class="tooltiptext">Configure System to Forward All Mail For The Root Account</span></div></li> </ul> <li class="collapsible">AU-5(b)</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">AU-5.1(ii)</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">postfix_client_configure_mail_alias<span class="tooltiptext">Configure System to Forward All Mail For The Root Account</span></div></li> </ul> <li class="collapsible">AU-5.1(iv)</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> </ul> <li class="collapsible">AU-6(3)</li> <ul class="content"> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> </ul> <li class="collapsible">AU-6(4)</li> <ul class="content"> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-6(4).1</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-7(1)</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-7(1).1</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-7(a)</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">AU-7(b)</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">AU-8(1)(a)</li> <ul class="content"> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> </ul> <li class="collapsible">AU-8(1)(b)</li> <ul class="content"> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> </ul> <li class="collapsible">AU-8(2)</li> <ul class="content"> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> </ul> <li class="collapsible">AU-8(b)</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">ensure_rtc_utc_configuration<span class="tooltiptext">Ensure real-time clock is set to UTC</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">AU-9</li> <ul class="content"> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">permissions_local_var_log_audit<span class="tooltiptext">Verify that Local Logs of the audit Daemon are not World-Readable</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> <li class="collapsible">AU-9(2)</li> <ul class="content"> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">AU-9(3)</li> <ul class="content"> <li><div class="tooltip">aide_check_audit_tools<span class="tooltiptext">Configure AIDE to Verify the Audit Tools</span></div></li> <li><div class="tooltip">auditd_audispd_encrypt_sent_records<span class="tooltiptext">Encrypt Audit Records Sent With audispd Plugin</span></div></li> </ul> <li class="collapsible">AU-9(3).1</li> <ul class="content"> <li><div class="tooltip">aide_check_audit_tools<span class="tooltiptext">Configure AIDE to Verify the Audit Tools</span></div></li> </ul> <li class="collapsible">AU-9(4)</li> <ul class="content"> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> </ul> <li class="collapsible">CA-3(5)</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> <li><div class="tooltip">service_SuSEfirewall2_enabled<span class="tooltiptext">Enable the SuSEfirewall 2</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">CM-11(a)</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">CM-11(b)</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">CM-5(1)</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">CM-5(3)</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">CM-5(6)</li> <ul class="content"> <li><div class="tooltip">run_chkstat<span class="tooltiptext">OS commands and libraries must have the proper permissions to protect from unauthorized access</span></div></li> </ul> <li class="collapsible">CM-6(a)</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_set_max_life_existing<span class="tooltiptext">Set Existing Passwords Maximum Age</span></div></li> <li><div class="tooltip">accounts_password_set_min_life_existing<span class="tooltiptext">Set Existing Passwords Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> <li><div class="tooltip">auditd_audispd_encrypt_sent_records<span class="tooltiptext">Encrypt Audit Records Sent With audispd Plugin</span></div></li> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">directory_access_var_log_audit<span class="tooltiptext">Record Access Events to Audit Log Directory</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_password_auth_for_systemaccounts<span class="tooltiptext">Ensure that System Accounts Are Locked</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_openssh_installed<span class="tooltiptext">Install the OpenSSH Client and Server Package</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_files_permissions<span class="tooltiptext">Ensure System Log Files Have Correct Permissions</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_set_loglevel_info<span class="tooltiptext">Set LogLevel to INFO</span></div></li> <li><div class="tooltip">sshd_set_loglevel_verbose<span class="tooltiptext">Set SSH Daemon LogLevel to VERBOSE</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> <li><div class="tooltip">sysctl_fs_protected_hardlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Hardlinks</span></div></li> <li><div class="tooltip">sysctl_fs_protected_symlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Symlinks</span></div></li> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">CM-6(b)</li> <ul class="content"> <li><div class="tooltip">accounts_authorized_local_users<span class="tooltiptext">Only Authorized Local User Accounts Exist on Operating System</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_passwords_pam_faildelay_delay<span class="tooltiptext">Enforce Delay After Failed Logon Attempts</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_retry<span class="tooltiptext">Set Password Retry Limit</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">pam_disable_automatic_configuration<span class="tooltiptext">The PAM configuration should not be changed automatically</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">sshd_disable_x11_forwarding<span class="tooltiptext">Disable X11 Forwarding</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> </ul> <li class="collapsible">CM-6.1</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_retry<span class="tooltiptext">Set Password Retry Limit</span></div></li> </ul> <li class="collapsible">CM-6.1(iv)</li> <ul class="content"> <li><div class="tooltip">accounts_authorized_local_users<span class="tooltiptext">Only Authorized Local User Accounts Exist on Operating System</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_passwords_pam_faildelay_delay<span class="tooltiptext">Enforce Delay After Failed Logon Attempts</span></div></li> <li><div class="tooltip">pam_disable_automatic_configuration<span class="tooltiptext">The PAM configuration should not be changed automatically</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> </ul> <li class="collapsible">CM-7</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> <li><div class="tooltip">service_SuSEfirewall2_enabled<span class="tooltiptext">Enable the SuSEfirewall 2</span></div></li> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">CM-7(a)</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">CM-7(b)</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">CM6(a)</li> <ul class="content"> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> </ul> <li class="collapsible">IA-11</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">IA-2</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">IA-2(1)</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(1).1</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(11)</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(12)</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(2)</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(2).1</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(3)</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(3).1</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(4)</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(4).1</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-2(5)</li> <ul class="content"> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">IA-2.1</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> </ul> <li class="collapsible">IA-4(e)</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> </ul> <li class="collapsible">IA-5 (1).1(v)</li> <ul class="content"> <li><div class="tooltip">accounts_password_pam_pwhistory_remember<span class="tooltiptext">Limit Password Reuse</span></div></li> </ul> <li class="collapsible">IA-5 (2)</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> </ul> <li class="collapsible">IA-5 (2).1</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> </ul> <li class="collapsible">IA-5(1)(a)</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_minlen<span class="tooltiptext">Set Password Minimum Length</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> </ul> <li class="collapsible">IA-5(1)(c)</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">set_password_hashing_min_rounds_logindefs<span class="tooltiptext">Set Password Hashing Rounds in /etc/login.defs</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">IA-5(1)(d)</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_set_max_life_existing<span class="tooltiptext">Set Existing Passwords Maximum Age</span></div></li> <li><div class="tooltip">accounts_password_set_min_life_existing<span class="tooltiptext">Set Existing Passwords Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> </ul> <li class="collapsible">IA-5(1)(e)</li> <ul class="content"> <li><div class="tooltip">accounts_password_pam_pwhistory_remember<span class="tooltiptext">Limit Password Reuse</span></div></li> <li><div class="tooltip">file_etc_security_opasswd<span class="tooltiptext">Verify Permissions and Ownership of Old Passwords File</span></div></li> </ul> <li class="collapsible">IA-5(1)(f)</li> <ul class="content"> <li><div class="tooltip">policy_temp_passwords_immediate_change<span class="tooltiptext">Policy Requires Immediate Change of Temporary Passwords</span></div></li> </ul> <li class="collapsible">IA-5(1).1(v)</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> <li><div class="tooltip">file_etc_security_opasswd<span class="tooltiptext">Verify Permissions and Ownership of Old Passwords File</span></div></li> <li><div class="tooltip">set_password_hashing_min_rounds_logindefs<span class="tooltiptext">Set Password Hashing Rounds in /etc/login.defs</span></div></li> </ul> <li class="collapsible">IA-5(13)</li> <ul class="content"> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> </ul> <li class="collapsible">IA-5(2)</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-5(2)(a)</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> </ul> <li class="collapsible">IA-5(2)(c)</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-5(2)(d)</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> </ul> <li class="collapsible">IA-5(2).1</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">IA-5(7)</li> <ul class="content"> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> </ul> <li class="collapsible">IA-5(a)</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_dcredit<span class="tooltiptext">Set Password Strength Minimum Digit Characters</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_lcredit<span class="tooltiptext">Set Password Strength Minimum Lowercase Characters</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_ocredit<span class="tooltiptext">Set Password Strength Minimum Special Characters</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_ucredit<span class="tooltiptext">Set Password Strength Minimum Uppercase Characters</span></div></li> </ul> <li class="collapsible">IA-5(b)</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_difok<span class="tooltiptext">Set Password Strength Minimum Different Characters</span></div></li> </ul> <li class="collapsible">IA-5(c)</li> <ul class="content"> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> </ul> <li class="collapsible">IA-5(f)</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_set_max_life_existing<span class="tooltiptext">Set Existing Passwords Maximum Age</span></div></li> <li><div class="tooltip">accounts_password_set_min_life_existing<span class="tooltiptext">Set Existing Passwords Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> </ul> <li class="collapsible">IA-5(h)</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> </ul> <li class="collapsible">IA-5(v)</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_dcredit<span class="tooltiptext">Set Password Strength Minimum Digit Characters</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_difok<span class="tooltiptext">Set Password Strength Minimum Different Characters</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_lcredit<span class="tooltiptext">Set Password Strength Minimum Lowercase Characters</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_ocredit<span class="tooltiptext">Set Password Strength Minimum Special Characters</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_ucredit<span class="tooltiptext">Set Password Strength Minimum Uppercase Characters</span></div></li> </ul> <li class="collapsible">IA-7</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">set_password_hashing_min_rounds_logindefs<span class="tooltiptext">Set Password Hashing Rounds in /etc/login.defs</span></div></li> </ul> <li class="collapsible">IA-7.1</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> <li><div class="tooltip">set_password_hashing_min_rounds_logindefs<span class="tooltiptext">Set Password Hashing Rounds in /etc/login.defs</span></div></li> </ul> <li class="collapsible">IA-8</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> </ul> <li class="collapsible">IA-8.1</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> </ul> <li class="collapsible">MA-4(1)(a)</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">MA-4(6)</li> <ul class="content"> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">MA-6</li> <ul class="content"> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> </ul> <li class="collapsible">MP-7</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">SA-12</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">SA-12(10)</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">SA-13(a)</li> <ul class="content"> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> </ul> <li class="collapsible">SC-10</li> <ul class="content"> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">SC-12</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> </ul> <li class="collapsible">SC-12(2)</li> <ul class="content"> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SC-12(3)</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SC-13</li> <ul class="content"> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SC-28</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">SC-28.1</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">SC-30</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">SC-30(2)</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">SC-30(5)</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> </ul> <li class="collapsible">SC-5</li> <ul class="content"> <li><div class="tooltip">susefirewall2_ddos_protection<span class="tooltiptext">Enable DoS Protections in SuSEfirewall2</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SC-5(1)</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SC-5(2)</li> <ul class="content"> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SC-5(3)(a)</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SC-7(21)</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> </ul> <li class="collapsible">SC-7(23)</li> <ul class="content"> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> </ul> <li class="collapsible">SC-7(a)</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SC-8</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SC-8(1)</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SC-8(2)</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SC-8(3)</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SC-8(4)</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SI-11(a)</li> <ul class="content"> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> </ul> <li class="collapsible">SI-11(b)</li> <ul class="content"> <li><div class="tooltip">sysctl_fs_suid_dumpable<span class="tooltiptext">Disable Core Dumps for SUID programs</span></div></li> </ul> <li class="collapsible">SI-11(c)</li> <ul class="content"> <li><div class="tooltip">file_permissions_local_var_log_messages<span class="tooltiptext">Verify that local /var/log/messages is not world-readable</span></div></li> </ul> <li class="collapsible">SI-2(5)</li> <ul class="content"> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">SI-2(6)</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> </ul> <li class="collapsible">SI-2(c)</li> <ul class="content"> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">SI-6d</li> <ul class="content"> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> </ul> <li class="collapsible">SI-7</li> <ul class="content"> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">SI-7(1)</li> <ul class="content"> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> </ul> </ul> <li class="collapsible">nist-csf</li> <ul class="content"> <li class="collapsible">DE.AE-1</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">DE.AE-2</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DE.AE-3</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">DE.AE-4</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DE.AE-5</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">DE.CM-1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">DE.CM-3</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">DE.CM-5</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DE.CM-6</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DE.CM-7</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">DE.DP-2</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DE.DP-3</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DE.DP-4</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">DE.DP-5</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">ID.AM-1</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">ID.AM-3</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">ID.RA-1</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">ID.SC-4</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> </ul> <li class="collapsible">PR.AC-1</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">PR.AC-3</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">PR.AC-4</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">PR.AC-5</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">PR.AC-6</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> </ul> <li class="collapsible">PR.AC-7</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_password_warn_age_login_defs<span class="tooltiptext">Set Password Warning Age</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">no_direct_root_logins<span class="tooltiptext">Direct root Logins Not Allowed</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">PR.DS-1</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">PR.DS-2</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">PR.DS-4</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">PR.DS-5</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_gshadow<span class="tooltiptext">Verify Group Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_gshadow<span class="tooltiptext">Verify User Who Owns gshadow File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_gshadow<span class="tooltiptext">Verify Permissions on gshadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> <li><div class="tooltip">file_permissions_home_dirs<span class="tooltiptext">Ensure that User Home Directories are not Group-Writable or World-Readable</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_unauthorized_world_writable<span class="tooltiptext">Ensure No World-Writable Files Exist</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">restrict_serial_port_logins<span class="tooltiptext">Restrict Serial Port Root Logins</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> </ul> <li class="collapsible">PR.DS-6</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">PR.DS-7</li> <ul class="content"> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> </ul> <li class="collapsible">PR.DS-8</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">PR.IP-1</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_root_path_dirs_no_write<span class="tooltiptext">Ensure that Root's Path Does Not Include World or Group-Writable Directories</span></div></li> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">root_path_no_dot<span class="tooltiptext">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">PR.IP-12</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">PR.IP-2</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">PR.IP-3</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">PR.IP-8</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">PR.MA-1</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">PR.MA-2</li> <ul class="content"> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> </ul> <li class="collapsible">PR.PT-1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_syslogng_installed<span class="tooltiptext">Ensure syslog-ng is Installed</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_tcp<span class="tooltiptext">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_accept_remote_messages_udp<span class="tooltiptext">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">service_syslogng_enabled<span class="tooltiptext">Enable syslog-ng Service</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">PR.PT-2</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> </ul> <li class="collapsible">PR.PT-3</li> <ul class="content"> <li><div class="tooltip">avahi_disable_publishing<span class="tooltiptext">Disable Avahi Publishing</span></div></li> <li><div class="tooltip">dhcp_server_minimize_served_info<span class="tooltiptext">Minimize Served Information</span></div></li> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">kernel_module_ipv6_option_disabled<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">kernel_module_rds_disabled<span class="tooltiptext">Disable RDS Support</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_netrc_files<span class="tooltiptext">Verify No netrc Files Exist</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_cron_installed<span class="tooltiptext">Install the cron service</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_cron_enabled<span class="tooltiptext">Enable cron Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">set_ip6tables_default_rule<span class="tooltiptext">Set Default ip6tables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule<span class="tooltiptext">Set Default iptables Policy for Incoming Packets</span></div></li> <li><div class="tooltip">set_iptables_default_rule_forward<span class="tooltiptext">Set Default iptables Policy for Forwarded Packets</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_limit_user_access<span class="tooltiptext">Limit Users' SSH Access</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_disable_ipv6<span class="tooltiptext">Disable IPv6 Networking Support Automatic Loading</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">PR.PT-4</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">no_rsh_trust_files<span class="tooltiptext">Remove Rsh Trust Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_inetutils-telnetd_removed<span class="tooltiptext">Uninstall the inet-based telnet server</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_telnetd-ssl_removed<span class="tooltiptext">Uninstall the ssl compliant telnet server</span></div></li> <li><div class="tooltip">package_telnetd_removed<span class="tooltiptext">Uninstall the telnet server</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_ip6tables_enabled<span class="tooltiptext">Verify ip6tables Enabled if Using IPv6</span></div></li> <li><div class="tooltip">service_iptables_enabled<span class="tooltiptext">Verify iptables Enabled</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">RS.AN-1</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">RS.AN-4</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">RS.CO-2</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> </ul> <li class="collapsible">RS.CO-3</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> </ul> <li class="collapsible">nisti</li> <ul class="content"> <li class="collapsible">AU-9</li> <ul class="content"> <li><div class="tooltip">permissions_local_audit_binaries<span class="tooltiptext">Verify Permissions of Local Logs of audit Tools</span></div></li> </ul> </ul> <li class="collapsible">ospp</li> <ul class="content"> <li class="collapsible">FAU_GEN.1</li> <ul class="content"> <li><div class="tooltip">auditd_freq<span class="tooltiptext">Set number of records to cause an explicit flush to audit logs</span></div></li> <li><div class="tooltip">auditd_log_format<span class="tooltiptext">Resolve information before writing to audit logs</span></div></li> <li><div class="tooltip">auditd_name_format<span class="tooltiptext">Set hostname as computer node name in audit logs</span></div></li> </ul> <li class="collapsible">FAU_GEN.1.1.c</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_encrypt_sent_records<span class="tooltiptext">Encrypt Audit Records Sent With audispd Plugin</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_local_events<span class="tooltiptext">Include Local Events in Audit Logs</span></div></li> <li><div class="tooltip">auditd_write_logs<span class="tooltiptext">Write Audit Logs to the Disk</span></div></li> <li><div class="tooltip">directory_access_var_log_audit<span class="tooltiptext">Record Access Events to Audit Log Directory</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">FCS_SSHC_EXT.1</li> <ul class="content"> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> </ul> <li class="collapsible">FCS_SSHS_EXT.1</li> <ul class="content"> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">sshd_rekey_limit<span class="tooltiptext">Force frequent session key renegotiation</span></div></li> </ul> <li class="collapsible">FIA_UAU.1</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> </ul> <li class="collapsible">FIA_UAU.5</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> </ul> <li class="collapsible">FIA_X509_EXT</li> <ul class="content"> <li><div class="tooltip">package_gnutls-utils_installed<span class="tooltiptext">Ensure gnutls-utils is installed</span></div></li> </ul> <li class="collapsible">FMT_MOF_EXT.1</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">FMT_SMF_EXT.1</li> <ul class="content"> <li><div class="tooltip">coredump_disable_backtraces<span class="tooltiptext">Disable core dump backtraces</span></div></li> <li><div class="tooltip">coredump_disable_storage<span class="tooltiptext">Disable storing core dump</span></div></li> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">package_chrony_installed<span class="tooltiptext">The Chrony package is installed</span></div></li> <li><div class="tooltip">package_nss-tools_installed<span class="tooltiptext">Ensure nss-tools is installed</span></div></li> </ul> <li class="collapsible">FMT_SMF_EXT.1.1</li> <ul class="content"> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> </ul> <li class="collapsible">FPT_TUD_EXT.1</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">FPT_TUD_EXT.2</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">FTA_TAB.1</li> <ul class="content"> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">FTP_ITC_EXT.1</li> <ul class="content"> <li><div class="tooltip">kerberos_disable_no_keytab<span class="tooltiptext">Disable Kerberos by removing host keytab</span></div></li> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> </ul> </ul> <li class="collapsible">pcidss</li> <ul class="content"> <li class="collapsible">Req-10.1</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">Req-10.2.1</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> </ul> <li class="collapsible">Req-10.2.2</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> </ul> <li class="collapsible">Req-10.2.3</li> <ul class="content"> <li><div class="tooltip">audit_rules_login_events<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_session_events<span class="tooltiptext">Record Attempts to Alter Process and Session Initiation Information</span></div></li> </ul> <li class="collapsible">Req-10.2.4</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification<span class="tooltiptext">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">Req-10.2.5</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">Req-10.2.5.b</li> <ul class="content"> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> </ul> <li class="collapsible">Req-10.2.7</li> <ul class="content"> <li><div class="tooltip">audit_rules_file_deletion_events<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> </ul> <li class="collapsible">Req-10.4</li> <ul class="content"> <li><div class="tooltip">package_ntp_installed<span class="tooltiptext">Install the ntp service</span></div></li> <li><div class="tooltip">service_ntp_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> <li><div class="tooltip">service_ntpd_enabled<span class="tooltiptext">Enable the NTP Daemon</span></div></li> </ul> <li class="collapsible">Req-10.4.1</li> <ul class="content"> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> </ul> <li class="collapsible">Req-10.4.2.b</li> <ul class="content"> <li><div class="tooltip">audit_rules_time_adjtimex<span class="tooltiptext">Record attempts to alter time through adjtimex</span></div></li> <li><div class="tooltip">audit_rules_time_clock_settime<span class="tooltiptext">Record Attempts to Alter Time Through clock_settime</span></div></li> <li><div class="tooltip">audit_rules_time_settimeofday<span class="tooltiptext">Record attempts to alter time through settimeofday</span></div></li> <li><div class="tooltip">audit_rules_time_stime<span class="tooltiptext">Record Attempts to Alter Time Through stime</span></div></li> <li><div class="tooltip">audit_rules_time_watch_localtime<span class="tooltiptext">Record Attempts to Alter the localtime File</span></div></li> </ul> <li class="collapsible">Req-10.4.3</li> <ul class="content"> <li><div class="tooltip">ntpd_specify_multiple_servers<span class="tooltiptext">Specify Additional Remote NTP Servers</span></div></li> <li><div class="tooltip">ntpd_specify_remote_server<span class="tooltiptext">Specify a Remote NTP Server</span></div></li> </ul> <li class="collapsible">Req-10.5.1</li> <ul class="content"> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_files_permissions<span class="tooltiptext">Ensure System Log Files Have Correct Permissions</span></div></li> </ul> <li class="collapsible">Req-10.5.2</li> <ul class="content"> <li><div class="tooltip">audit_rules_immutable<span class="tooltiptext">Make the auditd Configuration Immutable</span></div></li> <li><div class="tooltip">rsyslog_files_groupownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate Group</span></div></li> <li><div class="tooltip">rsyslog_files_ownership<span class="tooltiptext">Ensure Log Files Are Owned By Appropriate User</span></div></li> <li><div class="tooltip">rsyslog_files_permissions<span class="tooltiptext">Ensure System Log Files Have Correct Permissions</span></div></li> </ul> <li class="collapsible">Req-10.5.3</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> </ul> <li class="collapsible">Req-10.5.5</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_mac_modification<span class="tooltiptext">Record Events that Modify the System's Mandatory Access Controls</span></div></li> <li><div class="tooltip">audit_rules_networkconfig_modification<span class="tooltiptext">Record Events that Modify the System's Network Environment</span></div></li> </ul> <li class="collapsible">Req-10.7</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file<span class="tooltiptext">Configure auditd Max Log File Size</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> <li><div class="tooltip">auditd_data_retention_num_logs<span class="tooltiptext">Configure auditd Number of Logs Retained</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">ensure_logrotate_activated<span class="tooltiptext">Ensure Logrotate Runs Periodically</span></div></li> </ul> <li class="collapsible">Req-10.7.a</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">Req-11.4</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">Req-11.5</li> <ul class="content"> <li><div class="tooltip">aide_build_database<span class="tooltiptext">Build and Test AIDE Database</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">Req-6.2</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">Req-8.1.1</li> <ul class="content"> <li><div class="tooltip">account_unique_name<span class="tooltiptext">Ensure All Accounts on the System Have Unique Names</span></div></li> </ul> <li class="collapsible">Req-8.1.4</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> </ul> <li class="collapsible">Req-8.1.8</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">Req-8.2.1</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed<span class="tooltiptext">Verify All Account Password Hashes are Shadowed</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> </ul> <li class="collapsible">Req-8.2.3</li> <ul class="content"> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> </ul> <li class="collapsible">Req-8.2.4</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> </ul> <li class="collapsible">Req-8.5.a</li> <ul class="content"> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> </ul> <li class="collapsible">Req-8.7.c</li> <ul class="content"> <li><div class="tooltip">file_groupowner_etc_group<span class="tooltiptext">Verify Group Who Owns group File</span></div></li> <li><div class="tooltip">file_groupowner_etc_passwd<span class="tooltiptext">Verify Group Who Owns passwd File</span></div></li> <li><div class="tooltip">file_groupowner_etc_shadow<span class="tooltiptext">Verify Group Who Owns shadow File</span></div></li> <li><div class="tooltip">file_owner_etc_group<span class="tooltiptext">Verify User Who Owns group File</span></div></li> <li><div class="tooltip">file_owner_etc_passwd<span class="tooltiptext">Verify User Who Owns passwd File</span></div></li> <li><div class="tooltip">file_owner_etc_shadow<span class="tooltiptext">Verify User Who Owns shadow File</span></div></li> <li><div class="tooltip">file_permissions_etc_group<span class="tooltiptext">Verify Permissions on group File</span></div></li> <li><div class="tooltip">file_permissions_etc_passwd<span class="tooltiptext">Verify Permissions on passwd File</span></div></li> <li><div class="tooltip">file_permissions_etc_shadow<span class="tooltiptext">Verify Permissions on shadow File</span></div></li> </ul> </ul> <li class="collapsible">srg</li> <ul class="content"> <li class="collapsible">SRG-OS-000002-GPOS-00002</li> <ul class="content"> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">SRG-OS-000004-GPOS-00004</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000021-GPOS-00005</li> <ul class="content"> <li><div class="tooltip">accounts_passwords_pam_tally2<span class="tooltiptext">Set Deny For Failed Password Attempts</span></div></li> </ul> <li class="collapsible">SRG-OS-000023-GPOS-00006</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">gui_login_dod_acknowledgement<span class="tooltiptext">Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">SRG-OS-000024-GPOS-00007</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">SRG-OS-000027-GPOS-00008</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> </ul> <li class="collapsible">SRG-OS-000028-GPOS-00009</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> <li><div class="tooltip">vlock_installed<span class="tooltiptext">Check that vlock is installed to allow session locking</span></div></li> </ul> <li class="collapsible">SRG-OS-000029-GPOS-00010</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> </ul> <li class="collapsible">SRG-OS-000030-GPOS-00011</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> </ul> <li class="collapsible">SRG-OS-000031-GPOS-00012</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> </ul> <li class="collapsible">SRG-OS-000032-GPOS-00013</li> <ul class="content"> <li><div class="tooltip">sshd_set_loglevel_verbose<span class="tooltiptext">Set SSH Daemon LogLevel to VERBOSE</span></div></li> </ul> <li class="collapsible">SRG-OS-000033-GPOS-00014</li> <ul class="content"> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">sshd_rekey_limit<span class="tooltiptext">Force frequent session key renegotiation</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SRG-OS-000037-GPOS-00015</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000038-GPOS-00016</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000039-GPOS-00017</li> <ul class="content"> <li><div class="tooltip">auditd_name_format<span class="tooltiptext">Set hostname as computer node name in audit logs</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000040-GPOS-00018</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000041-GPOS-00019</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000042-GPOS-00020</li> <ul class="content"> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> </ul> <li class="collapsible">SRG-OS-000042-GPOS-00021</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000046-GPOS-00022</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">postfix_client_configure_mail_alias<span class="tooltiptext">Configure System to Forward All Mail For The Root Account</span></div></li> </ul> <li class="collapsible">SRG-OS-000047-GPOS-00023</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_error_action<span class="tooltiptext">Configure auditd Disk Error Action on Disk Error</span></div></li> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> <li><div class="tooltip">auditd_data_retention_max_log_file_action<span class="tooltiptext">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</span></div></li> </ul> <li class="collapsible">SRG-OS-000051-GPOS-00024</li> <ul class="content"> <li><div class="tooltip">auditd_freq<span class="tooltiptext">Set number of records to cause an explicit flush to audit logs</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000054-GPOS-00025</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000057-GPOS-00027</li> <ul class="content"> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">permissions_local_var_log_audit<span class="tooltiptext">Verify that Local Logs of the audit Daemon are not World-Readable</span></div></li> </ul> <li class="collapsible">SRG-OS-000058-GPOS-00028</li> <ul class="content"> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">permissions_local_var_log_audit<span class="tooltiptext">Verify that Local Logs of the audit Daemon are not World-Readable</span></div></li> </ul> <li class="collapsible">SRG-OS-000059-GPOS-00029</li> <ul class="content"> <li><div class="tooltip">directory_permissions_var_log_audit<span class="tooltiptext">System Audit Logs Must Have Mode 0750 or Less Permissive</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">permissions_local_var_log_audit<span class="tooltiptext">Verify that Local Logs of the audit Daemon are not World-Readable</span></div></li> </ul> <li class="collapsible">SRG-OS-000062-GPOS-00031</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">auditd_local_events<span class="tooltiptext">Include Local Events in Audit Logs</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000064-GPOS-00033</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> </ul> <li class="collapsible">SRG-OS-000066-GPOS-00034</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> </ul> <li class="collapsible">SRG-OS-000068-GPOS-00036</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">SRG-OS-000069-GPOS-00037</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_ucredit<span class="tooltiptext">Set Password Strength Minimum Uppercase Characters</span></div></li> </ul> <li class="collapsible">SRG-OS-000070-GPOS-00038</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_lcredit<span class="tooltiptext">Set Password Strength Minimum Lowercase Characters</span></div></li> </ul> <li class="collapsible">SRG-OS-000071-GPOS-00039</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_dcredit<span class="tooltiptext">Set Password Strength Minimum Digit Characters</span></div></li> </ul> <li class="collapsible">SRG-OS-000072-GPOS-00040</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_difok<span class="tooltiptext">Set Password Strength Minimum Different Characters</span></div></li> </ul> <li class="collapsible">SRG-OS-000073-GPOS-00041</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">set_password_hashing_min_rounds_logindefs<span class="tooltiptext">Set Password Hashing Rounds in /etc/login.defs</span></div></li> </ul> <li class="collapsible">SRG-OS-000074-GPOS-00042</li> <ul class="content"> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> </ul> <li class="collapsible">SRG-OS-000075-GPOS-00043</li> <ul class="content"> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> <li><div class="tooltip">accounts_password_set_min_life_existing<span class="tooltiptext">Set Existing Passwords Minimum Age</span></div></li> </ul> <li class="collapsible">SRG-OS-000076-GPOS-00044</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> <li><div class="tooltip">accounts_password_set_max_life_existing<span class="tooltiptext">Set Existing Passwords Maximum Age</span></div></li> </ul> <li class="collapsible">SRG-OS-000077-GPOS-00045</li> <ul class="content"> <li><div class="tooltip">accounts_password_pam_pwhistory_remember<span class="tooltiptext">Limit Password Reuse</span></div></li> <li><div class="tooltip">file_etc_security_opasswd<span class="tooltiptext">Verify Permissions and Ownership of Old Passwords File</span></div></li> </ul> <li class="collapsible">SRG-OS-000078-GPOS-00046</li> <ul class="content"> <li><div class="tooltip">accounts_password_minlen_login_defs<span class="tooltiptext">Set Password Minimum Length in login.defs</span></div></li> <li><div class="tooltip">cracklib_accounts_password_pam_minlen<span class="tooltiptext">Set Password Minimum Length</span></div></li> </ul> <li class="collapsible">SRG-OS-000080-GPOS-00048</li> <ul class="content"> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> </ul> <li class="collapsible">SRG-OS-000095-GPOS-00049</li> <ul class="content"> <li><div class="tooltip">kernel_module_tipc_disabled<span class="tooltiptext">Disable TIPC Support</span></div></li> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> </ul> <li class="collapsible">SRG-OS-000096-GPOS-00050</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> <li><div class="tooltip">service_SuSEfirewall2_enabled<span class="tooltiptext">Enable the SuSEfirewall 2</span></div></li> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">SRG-OS-000104-GPOS-00051</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> <li><div class="tooltip">gid_passwd_group_same<span class="tooltiptext">All GIDs referenced in /etc/passwd must be defined in /etc/group</span></div></li> </ul> <li class="collapsible">SRG-OS-000105-GPOS-00052</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">SRG-OS-000106-GPOS-00053</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> </ul> <li class="collapsible">SRG-OS-000107-GPOS-00054</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">SRG-OS-000108-GPOS-00055</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">SRG-OS-000109-GPOS-00056</li> <ul class="content"> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">SRG-OS-000114-GPOS-00059</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">SRG-OS-000118-GPOS-00060</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> </ul> <li class="collapsible">SRG-OS-000120-GPOS-00061</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">kerberos_disable_no_keytab<span class="tooltiptext">Disable Kerberos by removing host keytab</span></div></li> <li><div class="tooltip">set_password_hashing_min_rounds_logindefs<span class="tooltiptext">Set Password Hashing Rounds in /etc/login.defs</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SRG-OS-000121-GPOS-00062</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> </ul> <li class="collapsible">SRG-OS-000122-GPOS-00063</li> <ul class="content"> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000123-GPOS-00064</li> <ul class="content"> <li><div class="tooltip">account_emergency_admin<span class="tooltiptext">Never Automatically Remove or Disable Emergency Administrator Accounts</span></div></li> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">SRG-OS-000125-GPOS-00065</li> <ul class="content"> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SRG-OS-000126-GPOS-00066</li> <ul class="content"> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> </ul> <li class="collapsible">SRG-OS-000132-GPOS-00067</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> </ul> <li class="collapsible">SRG-OS-000138-GPOS-00069</li> <ul class="content"> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> </ul> <li class="collapsible">SRG-OS-000142-GPOS-00071</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SRG-OS-000163-GPOS-00072</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">SRG-OS-000185-GPOS-00079</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">SRG-OS-000191-GPOS-00080</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">SRG-OS-000196</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">SRG-OS-000206-GPOS-00084</li> <ul class="content"> <li><div class="tooltip">file_groupowner_var_log<span class="tooltiptext">Verify Group Who Owns /var/log Directory</span></div></li> <li><div class="tooltip">file_groupowner_var_log_messages<span class="tooltiptext">Verify Group Who Owns /var/log/messages File</span></div></li> <li><div class="tooltip">file_owner_var_log<span class="tooltiptext">Verify User Who Owns /var/log Directory</span></div></li> <li><div class="tooltip">file_owner_var_log_messages<span class="tooltiptext">Verify User Who Owns /var/log/messages File</span></div></li> <li><div class="tooltip">file_ownership_var_log_audit<span class="tooltiptext">System Audit Logs Must Be Owned By Root</span></div></li> <li><div class="tooltip">file_permissions_local_var_log_messages<span class="tooltiptext">Verify that local /var/log/messages is not world-readable</span></div></li> <li><div class="tooltip">file_permissions_var_log<span class="tooltiptext">Verify Permissions on /var/log Directory</span></div></li> <li><div class="tooltip">file_permissions_var_log_messages<span class="tooltiptext">Verify Permissions on /var/log/messages File</span></div></li> </ul> <li class="collapsible">SRG-OS-000228-GPOS-00088</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">SRG-OS-000239-GPOS-00089</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000240-GPOS-00090</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000241-GPOS-00090</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> </ul> <li class="collapsible">SRG-OS-000241-GPOS-00091</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000250-GPOS-00093</li> <ul class="content"> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">harden_sshd_crypto_policy<span class="tooltiptext">Harden SSHD Crypto Policy</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SRG-OS-000254-GPOS-00095</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000255-GPOS-00096</li> <ul class="content"> <li><div class="tooltip">auditd_log_format<span class="tooltiptext">Resolve information before writing to audit logs</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000256-GPOS-00097</li> <ul class="content"> <li><div class="tooltip">permissions_local_audit_binaries<span class="tooltiptext">Verify Permissions of Local Logs of audit Tools</span></div></li> </ul> <li class="collapsible">SRG-OS-000257-GPOS-00098</li> <ul class="content"> <li><div class="tooltip">permissions_local_audit_binaries<span class="tooltiptext">Verify Permissions of Local Logs of audit Tools</span></div></li> </ul> <li class="collapsible">SRG-OS-000258-GPOS-00099</li> <ul class="content"> <li><div class="tooltip">permissions_local_audit_binaries<span class="tooltiptext">Verify Permissions of Local Logs of audit Tools</span></div></li> </ul> <li class="collapsible">SRG-OS-000259-GPOS-00100</li> <ul class="content"> <li><div class="tooltip">file_ownership_binary_dirs<span class="tooltiptext">Verify that System Executables Have Root Ownership</span></div></li> <li><div class="tooltip">file_ownership_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Root Ownership</span></div></li> <li><div class="tooltip">file_permissions_binary_dirs<span class="tooltiptext">Verify that System Executables Have Restrictive Permissions</span></div></li> <li><div class="tooltip">file_permissions_library_dirs<span class="tooltiptext">Verify that Shared Library Files Have Restrictive Permissions</span></div></li> <li><div class="tooltip">run_chkstat<span class="tooltiptext">OS commands and libraries must have the proper permissions to protect from unauthorized access</span></div></li> </ul> <li class="collapsible">SRG-OS-000266-GPOS-00101</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_ocredit<span class="tooltiptext">Set Password Strength Minimum Special Characters</span></div></li> </ul> <li class="collapsible">SRG-OS-000274-GPOS-00104</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> </ul> <li class="collapsible">SRG-OS-000275-GPOS-00105</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> </ul> <li class="collapsible">SRG-OS-000276-GPOS-00106</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> </ul> <li class="collapsible">SRG-OS-000277-GPOS-00107</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> </ul> <li class="collapsible">SRG-OS-000278-GPOS-00108</li> <ul class="content"> <li><div class="tooltip">aide_check_audit_tools<span class="tooltiptext">Configure AIDE to Verify the Audit Tools</span></div></li> </ul> <li class="collapsible">SRG-OS-000279-GPOS-00109</li> <ul class="content"> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">SRG-OS-000297-GPOS-00115</li> <ul class="content"> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">SRG-OS-000299-GPOS-00117</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SRG-OS-000300-GPOS-00118</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SRG-OS-000303-GPOS-00120</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000324-GPOS-00125</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">securetty_root_login_console_only<span class="tooltiptext">Restrict Virtual Console Root Logins</span></div></li> <li><div class="tooltip">sysctl_fs_protected_hardlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Hardlinks</span></div></li> <li><div class="tooltip">sysctl_fs_protected_symlinks<span class="tooltiptext">Enable Kernel Parameter to Enforce DAC on Symlinks</span></div></li> </ul> <li class="collapsible">SRG-OS-000327-GPOS-00127</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> </ul> <li class="collapsible">SRG-OS-000337-GPOS-00129</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000341-GPOS-00132</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_sufficiently_large_partition<span class="tooltiptext">Configure a Sufficiently Large Partition for Audit Logs</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> </ul> <li class="collapsible">SRG-OS-000342-GPOS-00133</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_configure_sufficiently_large_partition<span class="tooltiptext">Configure a Sufficiently Large Partition for Audit Logs</span></div></li> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> <li><div class="tooltip">auditd_audispd_encrypt_sent_records<span class="tooltiptext">Encrypt Audit Records Sent With audispd Plugin</span></div></li> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_name_format<span class="tooltiptext">Set hostname as computer node name in audit logs</span></div></li> <li><div class="tooltip">package_audit-audispd-plugins_installed<span class="tooltiptext">Ensure the default plugins for the audit dispatcher are Installed</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">SRG-OS-000343-GPOS-00134</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_admin_space_left_action<span class="tooltiptext">Configure auditd admin_space_left Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">SRG-OS-000348-GPOS-00136</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000349-GPOS-00137</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000350-GPOS-00138</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000351-GPOS-00139</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000352-GPOS-00140</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000353-GPOS-00141</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000354-GPOS-00142</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000355-GPOS-00143</li> <ul class="content"> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> <li><div class="tooltip">package_chrony_installed<span class="tooltiptext">The Chrony package is installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000356-GPOS-00144</li> <ul class="content"> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> </ul> <li class="collapsible">SRG-OS-000358-GPOS-00145</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000359-GPOS-00146</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">ensure_rtc_utc_configuration<span class="tooltiptext">Ensure real-time clock is set to UTC</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000363-GPOS-00150</li> <ul class="content"> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">SRG-OS-000364-GPOS-00151</li> <ul class="content"> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> </ul> <li class="collapsible">SRG-OS-000365-GPOS-00152</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000366-GPOS-00153</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">SRG-OS-000368-GPOS-00154</li> <ul class="content"> <li><div class="tooltip">mount_option_dev_shm_nodev<span class="tooltiptext">Add nodev Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_dev_shm_nosuid<span class="tooltiptext">Add nosuid Option to /dev/shm</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> </ul> <li class="collapsible">SRG-OS-000373-GPOS-00156</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> <li><div class="tooltip">sudo_require_authentication<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo</span></div></li> </ul> <li class="collapsible">SRG-OS-000373-GPOS-00157</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> </ul> <li class="collapsible">SRG-OS-000373-GPOS-00158</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> </ul> <li class="collapsible">SRG-OS-000375-GPOS-00160</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">smartcard_configure_cert_checking<span class="tooltiptext">Configure Smart Card Certificate Status Checking</span></div></li> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">SRG-OS-000375-GPOS-00161</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">SRG-OS-000375-GPOS-00162</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">SRG-OS-000376-GPOS-00161</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_cert_checking<span class="tooltiptext">Configure Smart Card Certificate Status Checking</span></div></li> </ul> <li class="collapsible">SRG-OS-000377-GPOS-00162</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> <li><div class="tooltip">smartcard_configure_cert_checking<span class="tooltiptext">Configure Smart Card Certificate Status Checking</span></div></li> </ul> <li class="collapsible">SRG-OS-000378-GPOS-00163</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">SRG-OS-000380-GPOS-00165</li> <ul class="content"> <li><div class="tooltip">policy_temp_passwords_immediate_change<span class="tooltiptext">Policy Requires Immediate Change of Temporary Passwords</span></div></li> </ul> <li class="collapsible">SRG-OS-000383-GPOS-00166</li> <ul class="content"> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> </ul> <li class="collapsible">SRG-OS-000384-GPOS-00167</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> <li><div class="tooltip">smartcard_configure_cert_checking<span class="tooltiptext">Configure Smart Card Certificate Status Checking</span></div></li> </ul> <li class="collapsible">SRG-OS-000392-GPOS-00172</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000393-GPOS-00173</li> <ul class="content"> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SRG-OS-000394-GPOS-00174</li> <ul class="content"> <li><div class="tooltip">harden_ssh_client_crypto_policy<span class="tooltiptext">Harden SSH client Crypto Policy</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SRG-OS-000395-GPOS-00175</li> <ul class="content"> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> </ul> <li class="collapsible">SRG-OS-000404-GPOS-00183</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">SRG-OS-000405-GPOS-00184</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">SRG-OS-000420-GPOS-00186</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> <li><div class="tooltip">service_SuSEfirewall2_enabled<span class="tooltiptext">Enable the SuSEfirewall 2</span></div></li> <li><div class="tooltip">susefirewall2_ddos_protection<span class="tooltiptext">Enable DoS Protections in SuSEfirewall2</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SRG-OS-000423-GPOS-00187</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">package_openssh_installed<span class="tooltiptext">Install the OpenSSH Client and Server Package</span></div></li> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000423-GPOS-00188</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000423-GPOS-00189</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000423-GPOS-00190</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000424-GPOS-00188</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SRG-OS-000425-GPOS-00189</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> </ul> <li class="collapsible">SRG-OS-000426-GPOS-00190</li> <ul class="content"> <li><div class="tooltip">package_openssh-server_installed<span class="tooltiptext">Install the OpenSSH Server Package</span></div></li> </ul> <li class="collapsible">SRG-OS-000433-GPOS-00192</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> </ul> <li class="collapsible">SRG-OS-000433-GPOS-00193</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">SRG-OS-000437-GPOS-00194</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> </ul> <li class="collapsible">SRG-OS-000445-GPOS-00199</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> <li class="collapsible">SRG-OS-000447-GPOS-00201</li> <ul class="content"> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> </ul> <li class="collapsible">SRG-OS-000458-GPOS-00203</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> </ul> <li class="collapsible">SRG-OS-000461-GPOS-00205</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> </ul> <li class="collapsible">SRG-OS-000462-GPOS-00206</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> </ul> <li class="collapsible">SRG-OS-000462-GPOS-00206SRG-OS-000471-GPOS-00215</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> </ul> <li class="collapsible">SRG-OS-000463-GPOS-00207</li> <ul class="content"> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> </ul> <li class="collapsible">SRG-OS-000465-GPOS-00209</li> <ul class="content"> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> </ul> <li class="collapsible">SRG-OS-000466-GPOS-00210</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> </ul> <li class="collapsible">SRG-OS-000467-GPOS-00211</li> <ul class="content"> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> </ul> <li class="collapsible">SRG-OS-000468-GPOS-00212</li> <ul class="content"> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> </ul> <li class="collapsible">SRG-OS-000470-GPOS-00214</li> <ul class="content"> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> </ul> <li class="collapsible">SRG-OS-000471-GPOS-00215</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> </ul> <li class="collapsible">SRG-OS-000471-GPOS-00216</li> <ul class="content"> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> </ul> <li class="collapsible">SRG-OS-000473-GPOS-00218</li> <ul class="content"> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> </ul> <li class="collapsible">SRG-OS-000474-GPOS-00219</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000475-GPOS-00220</li> <ul class="content"> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SRG-OS-000476-GPOS-00221</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification<span class="tooltiptext">Record Events that Modify User/Group Information</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000477-GPOS-00222</li> <ul class="content"> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> </ul> <li class="collapsible">SRG-OS-000479-GPOS-00224</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> <li><div class="tooltip">auditd_audispd_encrypt_sent_records<span class="tooltiptext">Encrypt Audit Records Sent With audispd Plugin</span></div></li> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> <li><div class="tooltip">auditd_name_format<span class="tooltiptext">Set hostname as computer node name in audit logs</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">SRG-OS-000480-GPOS-00225</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_retry<span class="tooltiptext">Set Password Retry Limit</span></div></li> </ul> <li class="collapsible">SRG-OS-000480-GPOS-00226</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_passwords_pam_faildelay_delay<span class="tooltiptext">Enforce Delay After Failed Logon Attempts</span></div></li> </ul> <li class="collapsible">SRG-OS-000480-GPOS-00227</li> <ul class="content"> <li><div class="tooltip">accounts_authorized_local_users<span class="tooltiptext">Only Authorized Local User Accounts Exist on Operating System</span></div></li> <li><div class="tooltip">accounts_have_homedir_login_defs<span class="tooltiptext">Ensure Home Directories are Created for New Users</span></div></li> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> <li><div class="tooltip">accounts_user_dot_no_world_writable_programs<span class="tooltiptext">User Initialization Files Must Not Run World-Writable Programs</span></div></li> <li><div class="tooltip">accounts_user_home_paths_only<span class="tooltiptext">Ensure that Users Path Contains Only Local Directories</span></div></li> <li><div class="tooltip">accounts_user_interactive_home_directory_defined<span class="tooltiptext">All Interactive Users Must Have A Home Directory Defined</span></div></li> <li><div class="tooltip">accounts_user_interactive_home_directory_exists<span class="tooltiptext">All Interactive Users Home Directories Must Exist</span></div></li> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> <li><div class="tooltip">audit_rules_enable_syscall_auditing<span class="tooltiptext">Remove Default Configuration to Disable Syscall Auditing</span></div></li> <li><div class="tooltip">auditd_local_events<span class="tooltiptext">Include Local Events in Audit Logs</span></div></li> <li><div class="tooltip">auditd_log_format<span class="tooltiptext">Resolve information before writing to audit logs</span></div></li> <li><div class="tooltip">auditd_write_logs<span class="tooltiptext">Write Audit Logs to the Disk</span></div></li> <li><div class="tooltip">coredump_disable_backtraces<span class="tooltiptext">Disable core dump backtraces</span></div></li> <li><div class="tooltip">coredump_disable_storage<span class="tooltiptext">Disable storing core dump</span></div></li> <li><div class="tooltip">dconf_db_up_to_date<span class="tooltiptext">Make sure that the dconf databases are up-to-date with regards to respective keyfiles</span></div></li> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> <li><div class="tooltip">file_groupownership_home_directories<span class="tooltiptext">All Interactive User Home Directories Must Be Group-Owned By The Primary User</span></div></li> <li><div class="tooltip">file_permission_user_init_files<span class="tooltiptext">Ensure All User Initialization Files Have Mode 0740 Or Less Permissive</span></div></li> <li><div class="tooltip">file_permissions_home_directories<span class="tooltiptext">All Interactive User Home Directories Must Have mode 0750 Or Less Permissive</span></div></li> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> <li><div class="tooltip">no_host_based_files<span class="tooltiptext">Remove Host-Based Authentication Files</span></div></li> <li><div class="tooltip">no_user_host_based_files<span class="tooltiptext">Remove User Host-Based Authentication Files</span></div></li> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> <li><div class="tooltip">package_gnutls-utils_installed<span class="tooltiptext">Ensure gnutls-utils is installed</span></div></li> <li><div class="tooltip">package_nss-tools_installed<span class="tooltiptext">Ensure nss-tools is installed</span></div></li> <li><div class="tooltip">package_rsyslog_installed<span class="tooltiptext">Ensure rsyslog is Installed</span></div></li> <li><div class="tooltip">package_vsftpd_removed<span class="tooltiptext">Uninstall vsftpd Package</span></div></li> <li><div class="tooltip">pam_disable_automatic_configuration<span class="tooltiptext">The PAM configuration should not be changed automatically</span></div></li> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_tmp<span class="tooltiptext">Ensure /tmp Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log<span class="tooltiptext">Ensure /var/log Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> <li><div class="tooltip">service_rsyslog_enabled<span class="tooltiptext">Enable rsyslog Service</span></div></li> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> <li><div class="tooltip">sshd_disable_rhosts_rsa<span class="tooltiptext">Disable SSH Support for Rhosts RSA Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> <li><div class="tooltip">sshd_disable_x11_forwarding<span class="tooltiptext">Disable X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> <li><div class="tooltip">sshd_rekey_limit<span class="tooltiptext">Force frequent session key renegotiation</span></div></li> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</span></div></li> <li><div class="tooltip">xwindows_runlevel_target<span class="tooltiptext">Disable X Windows Startup By Setting Default Target</span></div></li> </ul> <li class="collapsible">SRG-OS-000480-GPOS-00228</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> <li><div class="tooltip">accounts_umask_etc_profile<span class="tooltiptext">Ensure the Default Umask is Set Correctly in /etc/profile</span></div></li> </ul> <li class="collapsible">SRG-OS-000480-GPOS-00229</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> </ul> <li class="collapsible">SRG-OS-000480-GPOS-00231</li> <ul class="content"> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">SRG-OS-000480-GPOS-00232</li> <ul class="content"> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">SRG-OS-000481-GPOS-000481</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> </ul> <li class="collapsible">stigid</li> <ul class="content"> <li class="collapsible">SLES-12-010000</li> <ul class="content"> <li><div class="tooltip">installed_OS_is_vendor_supported<span class="tooltiptext">The Installed Operating System Is Vendor Supported</span></div></li> </ul> <li class="collapsible">SLES-12-010010</li> <ul class="content"> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> </ul> <li class="collapsible">SLES-12-010020</li> <ul class="content"> <li><div class="tooltip">gui_login_dod_acknowledgement<span class="tooltiptext">Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement</span></div></li> </ul> <li class="collapsible">SLES-12-010030</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> </ul> <li class="collapsible">SLES-12-010040</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_banner_enabled<span class="tooltiptext">Enable GNOME3 Login Warning Banner</span></div></li> </ul> <li class="collapsible">SLES-12-010050</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_login_banner_text<span class="tooltiptext">Set the GNOME3 Login Warning Banner Text</span></div></li> </ul> <li class="collapsible">SLES-12-010060</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_lock_enabled<span class="tooltiptext">Enable GNOME3 Screensaver Lock After Idle Period</span></div></li> </ul> <li class="collapsible">SLES-12-010070</li> <ul class="content"> <li><div class="tooltip">vlock_installed<span class="tooltiptext">Check that vlock is installed to allow session locking</span></div></li> </ul> <li class="collapsible">SLES-12-010080</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_idle_delay<span class="tooltiptext">Set GNOME3 Screensaver Inactivity Timeout</span></div></li> </ul> <li class="collapsible">SLES-12-010090</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> </ul> <li class="collapsible">SLES-12-010100</li> <ul class="content"> <li><div class="tooltip">dconf_gnome_screensaver_mode_blank<span class="tooltiptext">Implement Blank Screensaver</span></div></li> </ul> <li class="collapsible">SLES-12-010110</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> </ul> <li class="collapsible">SLES-12-010120</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> </ul> <li class="collapsible">SLES-12-010130</li> <ul class="content"> <li><div class="tooltip">accounts_passwords_pam_tally2<span class="tooltiptext">Set Deny For Failed Password Attempts</span></div></li> </ul> <li class="collapsible">SLES-12-010140</li> <ul class="content"> <li><div class="tooltip">accounts_logon_fail_delay<span class="tooltiptext">Ensure the Logon Failure Delay is Set Correctly in login.defs</span></div></li> </ul> <li class="collapsible">SLES-12-010150</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_ucredit<span class="tooltiptext">Set Password Strength Minimum Uppercase Characters</span></div></li> </ul> <li class="collapsible">SLES-12-010160</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_lcredit<span class="tooltiptext">Set Password Strength Minimum Lowercase Characters</span></div></li> </ul> <li class="collapsible">SLES-12-010170</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_dcredit<span class="tooltiptext">Set Password Strength Minimum Digit Characters</span></div></li> </ul> <li class="collapsible">SLES-12-010180</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_ocredit<span class="tooltiptext">Set Password Strength Minimum Special Characters</span></div></li> </ul> <li class="collapsible">SLES-12-010190</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_difok<span class="tooltiptext">Set Password Strength Minimum Different Characters</span></div></li> </ul> <li class="collapsible">SLES-12-010210</li> <ul class="content"> <li><div class="tooltip">set_password_hashing_algorithm_logindefs<span class="tooltiptext">Set Password Hashing Algorithm in /etc/login.defs</span></div></li> </ul> <li class="collapsible">SLES-12-010220</li> <ul class="content"> <li><div class="tooltip">accounts_password_all_shadowed_sha512<span class="tooltiptext">Verify All Account Password Hashes are Shadowed with SHA512</span></div></li> </ul> <li class="collapsible">SLES-12-010230</li> <ul class="content"> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> </ul> <li class="collapsible">SLES-12-010231</li> <ul class="content"> <li><div class="tooltip">no_empty_passwords<span class="tooltiptext">Prevent Login to Accounts With Empty Password</span></div></li> </ul> <li class="collapsible">SLES-12-010240</li> <ul class="content"> <li><div class="tooltip">set_password_hashing_min_rounds_logindefs<span class="tooltiptext">Set Password Hashing Rounds in /etc/login.defs</span></div></li> </ul> <li class="collapsible">SLES-12-010250</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_minlen<span class="tooltiptext">Set Password Minimum Length</span></div></li> </ul> <li class="collapsible">SLES-12-010260</li> <ul class="content"> <li><div class="tooltip">accounts_password_set_min_life_existing<span class="tooltiptext">Set Existing Passwords Minimum Age</span></div></li> </ul> <li class="collapsible">SLES-12-010270</li> <ul class="content"> <li><div class="tooltip">accounts_minimum_age_login_defs<span class="tooltiptext">Set Password Minimum Age</span></div></li> </ul> <li class="collapsible">SLES-12-010280</li> <ul class="content"> <li><div class="tooltip">accounts_maximum_age_login_defs<span class="tooltiptext">Set Password Maximum Age</span></div></li> </ul> <li class="collapsible">SLES-12-010290</li> <ul class="content"> <li><div class="tooltip">accounts_password_set_max_life_existing<span class="tooltiptext">Set Existing Passwords Maximum Age</span></div></li> </ul> <li class="collapsible">SLES-12-010300</li> <ul class="content"> <li><div class="tooltip">file_etc_security_opasswd<span class="tooltiptext">Verify Permissions and Ownership of Old Passwords File</span></div></li> </ul> <li class="collapsible">SLES-12-010310</li> <ul class="content"> <li><div class="tooltip">accounts_password_pam_pwhistory_remember<span class="tooltiptext">Limit Password Reuse</span></div></li> </ul> <li class="collapsible">SLES-12-010320</li> <ul class="content"> <li><div class="tooltip">cracklib_accounts_password_pam_retry<span class="tooltiptext">Set Password Retry Limit</span></div></li> </ul> <li class="collapsible">SLES-12-010330</li> <ul class="content"> <li><div class="tooltip">account_emergency_admin<span class="tooltiptext">Never Automatically Remove or Disable Emergency Administrator Accounts</span></div></li> </ul> <li class="collapsible">SLES-12-010340</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> </ul> <li class="collapsible">SLES-12-010360</li> <ul class="content"> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">SLES-12-010370</li> <ul class="content"> <li><div class="tooltip">accounts_passwords_pam_faildelay_delay<span class="tooltiptext">Enforce Delay After Failed Logon Attempts</span></div></li> </ul> <li class="collapsible">SLES-12-010380</li> <ul class="content"> <li><div class="tooltip">gnome_gdm_disable_automatic_login<span class="tooltiptext">Disable GDM Automatic Login</span></div></li> </ul> <li class="collapsible">SLES-12-010390</li> <ul class="content"> <li><div class="tooltip">display_login_attempts<span class="tooltiptext">Ensure PAM Displays Last Logon/Access Notification</span></div></li> </ul> <li class="collapsible">SLES-12-010400</li> <ul class="content"> <li><div class="tooltip">no_user_host_based_files<span class="tooltiptext">Remove User Host-Based Authentication Files</span></div></li> </ul> <li class="collapsible">SLES-12-010410</li> <ul class="content"> <li><div class="tooltip">no_host_based_files<span class="tooltiptext">Remove Host-Based Authentication Files</span></div></li> </ul> <li class="collapsible">SLES-12-010430</li> <ul class="content"> <li><div class="tooltip">grub2_password<span class="tooltiptext">Set Boot Loader Password in grub2</span></div></li> </ul> <li class="collapsible">SLES-12-010440</li> <ul class="content"> <li><div class="tooltip">grub2_uefi_password<span class="tooltiptext">Set the UEFI Boot Loader Password</span></div></li> </ul> <li class="collapsible">SLES-12-010450</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">SLES-12-010460</li> <ul class="content"> <li><div class="tooltip">dir_perms_world_writable_sticky_bits<span class="tooltiptext">Verify that All World-Writable Directories Have Sticky Bits Set</span></div></li> </ul> <li class="collapsible">SLES-12-010500</li> <ul class="content"> <li><div class="tooltip">package_aide_installed<span class="tooltiptext">Install AIDE</span></div></li> </ul> <li class="collapsible">SLES-12-010510</li> <ul class="content"> <li><div class="tooltip">aide_scan_notification<span class="tooltiptext">Configure Notification of Post-AIDE Scan Details</span></div></li> </ul> <li class="collapsible">SLES-12-010520</li> <ul class="content"> <li><div class="tooltip">aide_verify_acls<span class="tooltiptext">Configure AIDE to Verify Access Control Lists (ACLs)</span></div></li> </ul> <li class="collapsible">SLES-12-010530</li> <ul class="content"> <li><div class="tooltip">aide_verify_ext_attributes<span class="tooltiptext">Configure AIDE to Verify Extended Attributes</span></div></li> </ul> <li class="collapsible">SLES-12-010540</li> <ul class="content"> <li><div class="tooltip">aide_check_audit_tools<span class="tooltiptext">Configure AIDE to Verify the Audit Tools</span></div></li> </ul> <li class="collapsible">SLES-12-010550</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">SLES-12-010570</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> </ul> <li class="collapsible">SLES-12-010580</li> <ul class="content"> <li><div class="tooltip">kernel_module_usb-storage_disabled<span class="tooltiptext">Disable Modprobe Loading of USB Storage Driver</span></div></li> </ul> <li class="collapsible">SLES-12-010590</li> <ul class="content"> <li><div class="tooltip">service_autofs_disabled<span class="tooltiptext">Disable the Automounter</span></div></li> </ul> <li class="collapsible">SLES-12-010599</li> <ul class="content"> <li><div class="tooltip">package_MFEhiplsm_installed<span class="tooltiptext">Install the Host Intrusion Prevention System (HIPS) Module</span></div></li> </ul> <li class="collapsible">SLES-12-010610</li> <ul class="content"> <li><div class="tooltip">disable_ctrlaltdel_reboot<span class="tooltiptext">Disable Ctrl-Alt-Del Reboot Activation</span></div></li> </ul> <li class="collapsible">SLES-12-010620</li> <ul class="content"> <li><div class="tooltip">accounts_umask_etc_login_defs<span class="tooltiptext">Ensure the Default Umask is Set Correctly in login.defs</span></div></li> </ul> <li class="collapsible">SLES-12-010630</li> <ul class="content"> <li><div class="tooltip">accounts_authorized_local_users<span class="tooltiptext">Only Authorized Local User Accounts Exist on Operating System</span></div></li> </ul> <li class="collapsible">SLES-12-010640</li> <ul class="content"> <li><div class="tooltip">account_unique_id<span class="tooltiptext">Ensure All Accounts on the System Have Unique User IDs</span></div></li> </ul> <li class="collapsible">SLES-12-010650</li> <ul class="content"> <li><div class="tooltip">accounts_no_uid_except_zero<span class="tooltiptext">Verify Only Root Has UID 0</span></div></li> </ul> <li class="collapsible">SLES-12-010660</li> <ul class="content"> <li><div class="tooltip">policy_temp_passwords_immediate_change<span class="tooltiptext">Policy Requires Immediate Change of Temporary Passwords</span></div></li> </ul> <li class="collapsible">SLES-12-010670</li> <ul class="content"> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> </ul> <li class="collapsible">SLES-12-010680</li> <ul class="content"> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> </ul> <li class="collapsible">SLES-12-010690</li> <ul class="content"> <li><div class="tooltip">no_files_unowned_by_user<span class="tooltiptext">Ensure All Files Are Owned by a User</span></div></li> </ul> <li class="collapsible">SLES-12-010700</li> <ul class="content"> <li><div class="tooltip">file_permissions_ungroupowned<span class="tooltiptext">Ensure All Files Are Owned by a Group</span></div></li> </ul> <li class="collapsible">SLES-12-010710</li> <ul class="content"> <li><div class="tooltip">accounts_user_interactive_home_directory_defined<span class="tooltiptext">All Interactive Users Must Have A Home Directory Defined</span></div></li> </ul> <li class="collapsible">SLES-12-010720</li> <ul class="content"> <li><div class="tooltip">accounts_have_homedir_login_defs<span class="tooltiptext">Ensure Home Directories are Created for New Users</span></div></li> </ul> <li class="collapsible">SLES-12-010730</li> <ul class="content"> <li><div class="tooltip">accounts_user_interactive_home_directory_exists<span class="tooltiptext">All Interactive Users Home Directories Must Exist</span></div></li> </ul> <li class="collapsible">SLES-12-010740</li> <ul class="content"> <li><div class="tooltip">file_permissions_home_directories<span class="tooltiptext">All Interactive User Home Directories Must Have mode 0750 Or Less Permissive</span></div></li> </ul> <li class="collapsible">SLES-12-010750</li> <ul class="content"> <li><div class="tooltip">file_groupownership_home_directories<span class="tooltiptext">All Interactive User Home Directories Must Be Group-Owned By The Primary User</span></div></li> </ul> <li class="collapsible">SLES-12-010760</li> <ul class="content"> <li><div class="tooltip">file_permission_user_init_files<span class="tooltiptext">Ensure All User Initialization Files Have Mode 0740 Or Less Permissive</span></div></li> </ul> <li class="collapsible">SLES-12-010770</li> <ul class="content"> <li><div class="tooltip">accounts_user_home_paths_only<span class="tooltiptext">Ensure that Users Path Contains Only Local Directories</span></div></li> </ul> <li class="collapsible">SLES-12-010780</li> <ul class="content"> <li><div class="tooltip">accounts_user_dot_no_world_writable_programs<span class="tooltiptext">User Initialization Files Must Not Run World-Writable Programs</span></div></li> </ul> <li class="collapsible">SLES-12-010790</li> <ul class="content"> <li><div class="tooltip">mount_option_home_nosuid<span class="tooltiptext">Add nosuid Option to /home</span></div></li> </ul> <li class="collapsible">SLES-12-010800</li> <ul class="content"> <li><div class="tooltip">mount_option_nosuid_removable_partitions<span class="tooltiptext">Add nosuid Option to Removable Media Partitions</span></div></li> </ul> <li class="collapsible">SLES-12-010810</li> <ul class="content"> <li><div class="tooltip">mount_option_nosuid_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with nosuid</span></div></li> </ul> <li class="collapsible">SLES-12-010820</li> <ul class="content"> <li><div class="tooltip">mount_option_noexec_remote_filesystems<span class="tooltiptext">Mount Remote Filesystems with noexec</span></div></li> </ul> <li class="collapsible">SLES-12-010830</li> <ul class="content"> <li><div class="tooltip">dir_perms_world_writable_system_owned_group<span class="tooltiptext">Ensure All World-Writable Directories Are Group Owned by a System Account</span></div></li> </ul> <li class="collapsible">SLES-12-010840</li> <ul class="content"> <li><div class="tooltip">service_kdump_disabled<span class="tooltiptext">Disable KDump Kernel Crash Analyzer (kdump)</span></div></li> </ul> <li class="collapsible">SLES-12-010850</li> <ul class="content"> <li><div class="tooltip">partition_for_home<span class="tooltiptext">Ensure /home Located On Separate Partition</span></div></li> </ul> <li class="collapsible">SLES-12-010860</li> <ul class="content"> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> </ul> <li class="collapsible">SLES-12-010870</li> <ul class="content"> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> </ul> <li class="collapsible">SLES-12-010880</li> <ul class="content"> <li><div class="tooltip">run_chkstat<span class="tooltiptext">OS commands and libraries must have the proper permissions to protect from unauthorized access</span></div></li> </ul> <li class="collapsible">SLES-12-010890</li> <ul class="content"> <li><div class="tooltip">file_permissions_local_var_log_messages<span class="tooltiptext">Verify that local /var/log/messages is not world-readable</span></div></li> </ul> <li class="collapsible">SLES-12-010910</li> <ul class="content"> <li><div class="tooltip">pam_disable_automatic_configuration<span class="tooltiptext">The PAM configuration should not be changed automatically</span></div></li> </ul> <li class="collapsible">SLES-12-020000</li> <ul class="content"> <li><div class="tooltip">package_audit_installed<span class="tooltiptext">Ensure the audit Subsystem is Installed</span></div></li> </ul> <li class="collapsible">SLES-12-020010</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SLES-12-020020</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_sufficiently_large_partition<span class="tooltiptext">Configure a Sufficiently Large Partition for Audit Logs</span></div></li> </ul> <li class="collapsible">SLES-12-020030</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> </ul> <li class="collapsible">SLES-12-020040</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">SLES-12-020050</li> <ul class="content"> <li><div class="tooltip">postfix_client_configure_mail_alias<span class="tooltiptext">Configure System to Forward All Mail For The Root Account</span></div></li> </ul> <li class="collapsible">SLES-12-020060</li> <ul class="content"> <li><div class="tooltip">auditd_data_disk_full_action<span class="tooltiptext">Configure auditd Disk Full Action when Disk Space Is Full</span></div></li> </ul> <li class="collapsible">SLES-12-020070</li> <ul class="content"> <li><div class="tooltip">package_audit-audispd-plugins_installed<span class="tooltiptext">Ensure the default plugins for the audit dispatcher are Installed</span></div></li> </ul> <li class="collapsible">SLES-12-020080</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_encrypt_sent_records<span class="tooltiptext">Encrypt Audit Records Sent With audispd Plugin</span></div></li> </ul> <li class="collapsible">SLES-12-020090</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> </ul> <li class="collapsible">SLES-12-020100</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_network_failure_action<span class="tooltiptext">Configure audispd's Plugin network_failure_action On Network Failure</span></div></li> </ul> <li class="collapsible">SLES-12-020110</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_disk_full_action<span class="tooltiptext">Configure audispd's Plugin disk_full_action When Disk Is Full</span></div></li> </ul> <li class="collapsible">SLES-12-020120</li> <ul class="content"> <li><div class="tooltip">permissions_local_var_log_audit<span class="tooltiptext">Verify that Local Logs of the audit Daemon are not World-Readable</span></div></li> </ul> <li class="collapsible">SLES-12-020130</li> <ul class="content"> <li><div class="tooltip">permissions_local_audit_binaries<span class="tooltiptext">Verify Permissions of Local Logs of audit Tools</span></div></li> </ul> <li class="collapsible">SLES-12-020199</li> <ul class="content"> <li><div class="tooltip">audit_rules_enable_syscall_auditing<span class="tooltiptext">Remove Default Configuration to Disable Syscall Auditing</span></div></li> </ul> <li class="collapsible">SLES-12-020200</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> </ul> <li class="collapsible">SLES-12-020210</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> </ul> <li class="collapsible">SLES-12-020220</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SLES-12-020230</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> </ul> <li class="collapsible">SLES-12-020240</li> <ul class="content"> <li><div class="tooltip">audit_rules_suid_privilege_function<span class="tooltiptext">Record Events When Privileged Executables Are Run</span></div></li> </ul> <li class="collapsible">SLES-12-020250</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> </ul> <li class="collapsible">SLES-12-020260</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> </ul> <li class="collapsible">SLES-12-020280</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_chfn<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chfn</span></div></li> </ul> <li class="collapsible">SLES-12-020290</li> <ul class="content"> <li><div class="tooltip">audit_rules_media_export<span class="tooltiptext">Ensure auditd Collects Information on Exporting to Media (successful)</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> </ul> <li class="collapsible">SLES-12-020300</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_umount<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_umount2<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - umount2</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> </ul> <li class="collapsible">SLES-12-020310</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_ssh_agent<span class="tooltiptext">Record Any Attempts to Run ssh-agent</span></div></li> </ul> <li class="collapsible">SLES-12-020320</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> </ul> <li class="collapsible">SLES-12-020360</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_kmod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</span></div></li> </ul> <li class="collapsible">SLES-12-020370</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> </ul> <li class="collapsible">SLES-12-020380</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> </ul> <li class="collapsible">SLES-12-020390</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> </ul> <li class="collapsible">SLES-12-020400</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> </ul> <li class="collapsible">SLES-12-020410</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> </ul> <li class="collapsible">SLES-12-020420</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> </ul> <li class="collapsible">SLES-12-020430</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> </ul> <li class="collapsible">SLES-12-020440</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> </ul> <li class="collapsible">SLES-12-020450</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> </ul> <li class="collapsible">SLES-12-020460</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> </ul> <li class="collapsible">SLES-12-020470</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> </ul> <li class="collapsible">SLES-12-020480</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> </ul> <li class="collapsible">SLES-12-020490</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> </ul> <li class="collapsible">SLES-12-020500</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> </ul> <li class="collapsible">SLES-12-020510</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> </ul> <li class="collapsible">SLES-12-020520</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> </ul> <li class="collapsible">SLES-12-020530</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> </ul> <li class="collapsible">SLES-12-020540</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> </ul> <li class="collapsible">SLES-12-020550</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> </ul> <li class="collapsible">SLES-12-020560</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> </ul> <li class="collapsible">SLES-12-020570</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> </ul> <li class="collapsible">SLES-12-020580</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> </ul> <li class="collapsible">SLES-12-020590</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> </ul> <li class="collapsible">SLES-12-020600</li> <ul class="content"> <li><div class="tooltip">audit_rules_execution_chmod<span class="tooltiptext">Record Any Attempts to Run chmod</span></div></li> </ul> <li class="collapsible">SLES-12-020610</li> <ul class="content"> <li><div class="tooltip">audit_rules_execution_setfacl<span class="tooltiptext">Record Any Attempts to Run setfacl</span></div></li> </ul> <li class="collapsible">SLES-12-020620</li> <ul class="content"> <li><div class="tooltip">audit_rules_execution_chacl<span class="tooltiptext">Record Any Attempts to Run chacl</span></div></li> </ul> <li class="collapsible">SLES-12-020630</li> <ul class="content"> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> </ul> <li class="collapsible">SLES-12-020640</li> <ul class="content"> <li><div class="tooltip">audit_rules_execution_rm<span class="tooltiptext">Record Any Attempts to Run rm</span></div></li> </ul> <li class="collapsible">SLES-12-020650</li> <ul class="content"> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> </ul> <li class="collapsible">SLES-12-020660</li> <ul class="content"> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> </ul> <li class="collapsible">SLES-12-020670</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_passmass<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passmass</span></div></li> </ul> <li class="collapsible">SLES-12-020680</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> </ul> <li class="collapsible">SLES-12-020690</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> </ul> <li class="collapsible">SLES-12-020700</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_usermod<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</span></div></li> </ul> <li class="collapsible">SLES-12-020710</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> </ul> <li class="collapsible">SLES-12-020720</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> </ul> <li class="collapsible">SLES-12-020730</li> <ul class="content"> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> </ul> <li class="collapsible">SLES-12-020740</li> <ul class="content"> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> </ul> <li class="collapsible">SLES-12-020750</li> <ul class="content"> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> </ul> <li class="collapsible">SLES-12-020760</li> <ul class="content"> <li><div class="tooltip">audit_rules_login_events_faillog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillog</span></div></li> </ul> <li class="collapsible">SLES-12-030000</li> <ul class="content"> <li><div class="tooltip">package_telnet-server_removed<span class="tooltiptext">Uninstall telnet-server Package</span></div></li> </ul> <li class="collapsible">SLES-12-030010</li> <ul class="content"> <li><div class="tooltip">ftp_present_banner<span class="tooltiptext">Create Warning Banners for All FTP Users</span></div></li> </ul> <li class="collapsible">SLES-12-030020</li> <ul class="content"> <li><div class="tooltip">banner_etc_gdm_banner<span class="tooltiptext">Modify the System GUI Login Banner</span></div></li> </ul> <li class="collapsible">SLES-12-030030</li> <ul class="content"> <li><div class="tooltip">package_SuSEfirewall2_installed<span class="tooltiptext">Install SuSEfirewall2 Package</span></div></li> <li><div class="tooltip">service_SuSEfirewall2_enabled<span class="tooltiptext">Enable the SuSEfirewall 2</span></div></li> <li><div class="tooltip">susefirewall2_only_required_services<span class="tooltiptext">Only Allow Authorized Network Services in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">SLES-12-030040</li> <ul class="content"> <li><div class="tooltip">susefirewall2_ddos_protection<span class="tooltiptext">Enable DoS Protections in SuSEfirewall2</span></div></li> </ul> <li class="collapsible">SLES-12-030050</li> <ul class="content"> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">SLES-12-030100</li> <ul class="content"> <li><div class="tooltip">service_sshd_enabled<span class="tooltiptext">Enable the OpenSSH Service</span></div></li> </ul> <li class="collapsible">SLES-12-030110</li> <ul class="content"> <li><div class="tooltip">sshd_set_loglevel_verbose<span class="tooltiptext">Set SSH Daemon LogLevel to VERBOSE</span></div></li> </ul> <li class="collapsible">SLES-12-030130</li> <ul class="content"> <li><div class="tooltip">sshd_print_last_log<span class="tooltiptext">Enable SSH Print Last Log</span></div></li> </ul> <li class="collapsible">SLES-12-030140</li> <ul class="content"> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> </ul> <li class="collapsible">SLES-12-030150</li> <ul class="content"> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> </ul> <li class="collapsible">SLES-12-030151</li> <ul class="content"> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> </ul> <li class="collapsible">SLES-12-030170</li> <ul class="content"> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> </ul> <li class="collapsible">SLES-12-030180</li> <ul class="content"> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SLES-12-030190</li> <ul class="content"> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> </ul> <li class="collapsible">SLES-12-030191</li> <ul class="content"> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> </ul> <li class="collapsible">SLES-12-030200</li> <ul class="content"> <li><div class="tooltip">sshd_disable_user_known_hosts<span class="tooltiptext">Disable SSH Support for User Known Hosts</span></div></li> </ul> <li class="collapsible">SLES-12-030210</li> <ul class="content"> <li><div class="tooltip">file_permissions_sshd_pub_key<span class="tooltiptext">Verify Permissions on SSH Server Public *.pub Key Files</span></div></li> </ul> <li class="collapsible">SLES-12-030220</li> <ul class="content"> <li><div class="tooltip">file_permissions_sshd_private_key<span class="tooltiptext">Verify Permissions on SSH Server Private *_key Key Files</span></div></li> </ul> <li class="collapsible">SLES-12-030230</li> <ul class="content"> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> </ul> <li class="collapsible">SLES-12-030240</li> <ul class="content"> <li><div class="tooltip">sshd_use_priv_separation<span class="tooltiptext">Enable Use of Privilege Separation</span></div></li> </ul> <li class="collapsible">SLES-12-030250</li> <ul class="content"> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> </ul> <li class="collapsible">SLES-12-030260</li> <ul class="content"> <li><div class="tooltip">sshd_enable_x11_forwarding<span class="tooltiptext">Enable Encrypted X11 Forwarding</span></div></li> </ul> <li class="collapsible">SLES-12-030300</li> <ul class="content"> <li><div class="tooltip">chronyd_or_ntpd_set_maxpoll<span class="tooltiptext">Configure Time Service Maxpoll Interval</span></div></li> </ul> <li class="collapsible">SLES-12-030310</li> <ul class="content"> <li><div class="tooltip">ensure_rtc_utc_configuration<span class="tooltiptext">Ensure real-time clock is set to UTC</span></div></li> </ul> <li class="collapsible">SLES-12-030320</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_kptr_restrict<span class="tooltiptext">Restrict Exposed Kernel Pointer Addresses Access</span></div></li> </ul> <li class="collapsible">SLES-12-030330</li> <ul class="content"> <li><div class="tooltip">sysctl_kernel_randomize_va_space<span class="tooltiptext">Enable Randomized Layout of Virtual Address Space</span></div></li> </ul> <li class="collapsible">SLES-12-030340</li> <ul class="content"> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">SLES-12-030350</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_tcp_syncookies<span class="tooltiptext">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030360</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030361</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv6_conf_all_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030370</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_source_route<span class="tooltiptext">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</span></div></li> </ul> <li class="collapsible">SLES-12-030380</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_icmp_echo_ignore_broadcasts<span class="tooltiptext">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030390</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_accept_redirects<span class="tooltiptext">Disable Accepting ICMP Redirects for All IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030400</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030401</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv6_conf_default_accept_redirects<span class="tooltiptext">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030410</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_default_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</span></div></li> </ul> <li class="collapsible">SLES-12-030420</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_conf_all_send_redirects<span class="tooltiptext">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030430</li> <ul class="content"> <li><div class="tooltip">sysctl_net_ipv4_ip_forward<span class="tooltiptext">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030440</li> <ul class="content"> <li><div class="tooltip">network_sniffer_disabled<span class="tooltiptext">Ensure System is Not Acting as a Network Sniffer</span></div></li> </ul> <li class="collapsible">SLES-12-030450</li> <ul class="content"> <li><div class="tooltip">wireless_disable_interfaces<span class="tooltiptext">Deactivate Wireless Network Interfaces</span></div></li> </ul> <li class="collapsible">SLES-12-030500</li> <ul class="content"> <li><div class="tooltip">install_smartcard_packages<span class="tooltiptext">Install Smart Card Packages For Multifactor Authentication</span></div></li> </ul> <li class="collapsible">SLES-12-030510</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_cert_checking<span class="tooltiptext">Configure Smart Card Certificate Status Checking</span></div></li> </ul> <li class="collapsible">SLES-12-030520</li> <ul class="content"> <li><div class="tooltip">smartcard_pam_enabled<span class="tooltiptext">Enable Smart Card Logins in PAM</span></div></li> </ul> <li class="collapsible">SLES-12-030530</li> <ul class="content"> <li><div class="tooltip">smartcard_configure_ca<span class="tooltiptext">Configure Smart Card Certificate Authority Validation</span></div></li> </ul> </ul> <li class="collapsible">vmmsrg</li> <ul class="content"> <li class="collapsible">SRG-OS-000002-VMM-000020</li> <ul class="content"> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">SRG-OS-000003-VMM-000030</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> </ul> <li class="collapsible">SRG-OS-000004-VMM-000040</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000023-VMM-000060</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">SRG-OS-000024-VMM-000070</li> <ul class="content"> <li><div class="tooltip">banner_etc_issue<span class="tooltiptext">Modify the System Login Banner</span></div></li> <li><div class="tooltip">sshd_enable_warning_banner<span class="tooltiptext">Enable SSH Warning Banner</span></div></li> </ul> <li class="collapsible">SRG-OS-000027-VMM-000080</li> <ul class="content"> <li><div class="tooltip">accounts_max_concurrent_login_sessions<span class="tooltiptext">Limit the Number of Concurrent Login Sessions Allowed Per User</span></div></li> </ul> <li class="collapsible">SRG-OS-000032-VMM-000130</li> <ul class="content"> <li><div class="tooltip">rsyslog_remote_loghost<span class="tooltiptext">Ensure Logs Sent To Remote Host</span></div></li> </ul> <li class="collapsible">SRG-OS-000033-VMM-000140</li> <ul class="content"> <li><div class="tooltip">sshd_allow_only_protocol2<span class="tooltiptext">Allow Only SSH Protocol 2</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SRG-OS-000037-VMM-000150</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000038-VMM-000160</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000039-VMM-000170</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000040-VMM-000180</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000041-VMM-000190</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000046-VMM-000210</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">SRG-OS-000051-VMM-000230</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> </ul> <li class="collapsible">SRG-OS-000058-VMM-000270</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> </ul> <li class="collapsible">SRG-OS-000059-VMM-000280</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> </ul> <li class="collapsible">SRG-OS-000063-VMM-000310</li> <ul class="content"> <li><div class="tooltip">service_auditd_enabled<span class="tooltiptext">Enable auditd Service</span></div></li> </ul> <li class="collapsible">SRG-OS-000075-VMM000420</li> <ul class="content"> <li><div class="tooltip">accounts_password_set_min_life_existing<span class="tooltiptext">Set Existing Passwords Minimum Age</span></div></li> </ul> <li class="collapsible">SRG-OS-000076-VMM-000430</li> <ul class="content"> <li><div class="tooltip">accounts_password_set_max_life_existing<span class="tooltiptext">Set Existing Passwords Maximum Age</span></div></li> </ul> <li class="collapsible">SRG-OS-000107-VMM-000530</li> <ul class="content"> <li><div class="tooltip">sshd_disable_rhosts<span class="tooltiptext">Disable SSH Support for .rhosts Files</span></div></li> </ul> <li class="collapsible">SRG-OS-000118-VMM-000590</li> <ul class="content"> <li><div class="tooltip">account_disable_post_pw_expiration<span class="tooltiptext">Set Account Expiration Following Inactivity</span></div></li> </ul> <li class="collapsible">SRG-OS-000120-VMM-000600</li> <ul class="content"> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SRG-OS-000123-VMM-000620</li> <ul class="content"> <li><div class="tooltip">account_temp_expire_date<span class="tooltiptext">Assign Expiration Date to Temporary Accounts</span></div></li> </ul> <li class="collapsible">SRG-OS-000163-VMM-000700</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> </ul> <li class="collapsible">SRG-OS-000239-VMM-000810</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000240-VMM-000820</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000241-VMM-000830</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000274-VMM-000960</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000275-VMM-000970</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000276-VMM-000980</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000277-VMM-000990</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000279-VMM-001010</li> <ul class="content"> <li><div class="tooltip">accounts_tmout<span class="tooltiptext">Set Interactive Session Timeout</span></div></li> </ul> <li class="collapsible">SRG-OS-000303-VMM-001090</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000304-VMM-001100</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000341-VMM-001220</li> <ul class="content"> <li><div class="tooltip">partition_for_var<span class="tooltiptext">Ensure /var Located On Separate Partition</span></div></li> <li><div class="tooltip">partition_for_var_log_audit<span class="tooltiptext">Ensure /var/log/audit Located On Separate Partition</span></div></li> </ul> <li class="collapsible">SRG-OS-000343-VMM-001240</li> <ul class="content"> <li><div class="tooltip">auditd_data_retention_action_mail_acct<span class="tooltiptext">Configure auditd mail_acct Action on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left<span class="tooltiptext">Configure auditd space_left on Low Disk Space</span></div></li> <li><div class="tooltip">auditd_data_retention_space_left_action<span class="tooltiptext">Configure auditd space_left Action on Low Disk Space</span></div></li> </ul> <li class="collapsible">SRG-OS-000366-VMM-001430</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">SRG-OS-000370-VMM-001460</li> <ul class="content"> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">SRG-OS-000383-VMM-001570</li> <ul class="content"> <li><div class="tooltip">sssd_memcache_timeout<span class="tooltiptext">Configure SSSD's Memory Cache to Expire</span></div></li> <li><div class="tooltip">sssd_offline_cred_expiration<span class="tooltiptext">Configure SSSD to Expire Offline Credentials</span></div></li> </ul> <li class="collapsible">SRG-OS-000396-VMM-001590</li> <ul class="content"> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SRG-OS-000404-VMM-001650</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> <li><div class="tooltip">ensure_gpgcheck_globally_activated<span class="tooltiptext">Ensure gpgcheck Enabled In Main zypper Configuration</span></div></li> </ul> <li class="collapsible">SRG-OS-000405-VMM-001660</li> <ul class="content"> <li><div class="tooltip">encrypt_partitions<span class="tooltiptext">Encrypt Partitions</span></div></li> </ul> <li class="collapsible">SRG-OS-000437-VMM-001760</li> <ul class="content"> <li><div class="tooltip">clean_components_post_updating<span class="tooltiptext">Ensure zypper Removes Previous Package Versions</span></div></li> </ul> <li class="collapsible">SRG-OS-000458-VMM-001810</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> </ul> <li class="collapsible">SRG-OS-000461-VMM-001830</li> <ul class="content"> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_creat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - creat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_ftruncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - ftruncate</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_open_by_handle_at<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - open_by_handle_at</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_openat<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - openat</span></div></li> <li><div class="tooltip">audit_rules_unsuccessful_file_modification_truncate<span class="tooltiptext">Record Unsuccessful Access Attempts to Files - truncate</span></div></li> </ul> <li class="collapsible">SRG-OS-000462-VMM-001840</li> <ul class="content"> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> </ul> <li class="collapsible">SRG-OS-000463-VMM-001850</li> <ul class="content"> <li><div class="tooltip">audit_rules_execution_chcon<span class="tooltiptext">Record Any Attempts to Run chcon</span></div></li> </ul> <li class="collapsible">SRG-OS-000466-VMM-001870</li> <ul class="content"> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> </ul> <li class="collapsible">SRG-OS-000468-VMM-001890</li> <ul class="content"> <li><div class="tooltip">audit_rules_file_deletion_events_rename<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rename</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_renameat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - renameat</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_rmdir<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - rmdir</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlink<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlink</span></div></li> <li><div class="tooltip">audit_rules_file_deletion_events_unlinkat<span class="tooltiptext">Ensure auditd Collects File Deletion Events by User - unlinkat</span></div></li> </ul> <li class="collapsible">SRG-OS-000470-VMM-001900</li> <ul class="content"> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> </ul> <li class="collapsible">SRG-OS-000471-VMM-001910</li> <ul class="content"> <li><div class="tooltip">audit_rules_privileged_commands<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chage<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chage</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_chsh<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_crontab<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_gpasswd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_mount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - mount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_newgrp<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_pam_timestamp_check<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_passwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_ssh_keysign<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_su<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - su</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_sudo<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_umount<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - umount</span></div></li> <li><div class="tooltip">audit_rules_privileged_commands_unix_chkpwd<span class="tooltiptext">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</span></div></li> <li><div class="tooltip">audit_rules_sysadmin_actions<span class="tooltiptext">Ensure auditd Collects System Administrator Actions</span></div></li> </ul> <li class="collapsible">SRG-OS-000473-VMM-001930</li> <ul class="content"> <li><div class="tooltip">audit_rules_login_events_faillock<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - faillock</span></div></li> <li><div class="tooltip">audit_rules_login_events_lastlog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - lastlog</span></div></li> <li><div class="tooltip">audit_rules_login_events_tallylog<span class="tooltiptext">Record Attempts to Alter Logon and Logout Events - tallylog</span></div></li> </ul> <li class="collapsible">SRG-OS-000474-VMM-001940</li> <ul class="content"> <li><div class="tooltip">audit_rules_dac_modification_chmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_chown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - chown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmod<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmod</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchmodat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchmodat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fchownat<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fchownat</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_fsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lchown<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lchown</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lremovexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_lsetxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_removexattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - removexattr</span></div></li> <li><div class="tooltip">audit_rules_dac_modification_setxattr<span class="tooltiptext">Record Events that Modify the System's Discretionary Access Controls - setxattr</span></div></li> </ul> <li class="collapsible">SRG-OS-000476-VMM-001960</li> <ul class="content"> <li><div class="tooltip">audit_rules_usergroup_modification_group<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/group</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_gshadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/gshadow</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_opasswd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/security/opasswd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_passwd<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/passwd</span></div></li> <li><div class="tooltip">audit_rules_usergroup_modification_shadow<span class="tooltiptext">Record Events that Modify User/Group Information - /etc/shadow</span></div></li> </ul> <li class="collapsible">SRG-OS-000477-VMM-001970</li> <ul class="content"> <li><div class="tooltip">audit_rules_kernel_module_loading_delete<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_finit<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</span></div></li> <li><div class="tooltip">audit_rules_kernel_module_loading_init<span class="tooltiptext">Ensure auditd Collects Information on Kernel Module Loading - init_module</span></div></li> </ul> <li class="collapsible">SRG-OS-000478-VMM-001980</li> <ul class="content"> <li><div class="tooltip">installed_OS_is_FIPS_certified<span class="tooltiptext">The Installed Operating System Is FIPS 140-2 Certified</span></div></li> <li><div class="tooltip">sshd_use_approved_ciphers<span class="tooltiptext">Use Only FIPS 140-2 Validated Ciphers</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> <li class="collapsible">SRG-OS-000479-VMM-001990</li> <ul class="content"> <li><div class="tooltip">auditd_audispd_configure_remote_server<span class="tooltiptext">Configure audispd Plugin To Send Logs To Remote Server</span></div></li> <li><div class="tooltip">auditd_audispd_syslog_plugin_activated<span class="tooltiptext">Configure auditd to use audispd's syslog plugin</span></div></li> </ul> <li class="collapsible">SRG-OS-000480-VMM-002000</li> <ul class="content"> <li><div class="tooltip">disable_host_auth<span class="tooltiptext">Disable Host-Based Authentication</span></div></li> <li><div class="tooltip">security_patches_up_to_date<span class="tooltiptext">Ensure Software Patches Installed</span></div></li> <li><div class="tooltip">set_password_hashing_algorithm_systemauth<span class="tooltiptext">Set PAM's Password Hashing Algorithm</span></div></li> <li><div class="tooltip">sshd_disable_compression<span class="tooltiptext">Disable Compression Or Set Compression to delayed</span></div></li> <li><div class="tooltip">sshd_disable_empty_passwords<span class="tooltiptext">Disable SSH Access via Empty Passwords</span></div></li> <li><div class="tooltip">sshd_disable_gssapi_auth<span class="tooltiptext">Disable GSSAPI Authentication</span></div></li> <li><div class="tooltip">sshd_disable_kerb_auth<span class="tooltiptext">Disable Kerberos Authentication</span></div></li> <li><div class="tooltip">sshd_disable_root_login<span class="tooltiptext">Disable SSH Root Login</span></div></li> <li><div class="tooltip">sshd_do_not_permit_user_env<span class="tooltiptext">Do Not Allow SSH Environment Options</span></div></li> <li><div class="tooltip">sshd_enable_strictmodes<span class="tooltiptext">Enable Use of Strict Mode Checking</span></div></li> <li><div class="tooltip">sshd_set_idle_timeout<span class="tooltiptext">Set SSH Idle Timeout Interval</span></div></li> <li><div class="tooltip">sshd_set_keepalive<span class="tooltiptext">Set SSH Client Alive Count Max</span></div></li> <li><div class="tooltip">sshd_set_keepalive_0<span class="tooltiptext">Set SSH Client Alive Count Max to zero</span></div></li> <li><div class="tooltip">sshd_use_approved_macs<span class="tooltiptext">Use Only FIPS 140-2 Validated MACs</span></div></li> </ul> </ul> <li class="collapsible">vsrg</li> <ul class="content"> <li class="collapsible">SRG-OS-000373-VMM-001470</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> </ul> <li class="collapsible">SRG-OS-000373-VMM-001480</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> </ul> <li class="collapsible">SRG-OS-000373-VMM-001490</li> <ul class="content"> <li><div class="tooltip">sudo_remove_no_authenticate<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</span></div></li> <li><div class="tooltip">sudo_remove_nopasswd<span class="tooltiptext">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</span></div></li> </ul> <li class="collapsible">SRG-OS-000445-VMM-001780</li> <ul class="content"> <li><div class="tooltip">selinux_state<span class="tooltiptext">Ensure SELinux State is Enforcing</span></div></li> </ul> </ul> </ul> <script> var coll = document.getElementsByClassName("collapsible"); var i; for (i = 0; i < coll.length; i++) { coll[i].addEventListener("click", function() { this.classList.toggle("active"); var content = this.nextElementSibling; if (content.style.display === "block") { content.style.display = "none"; } else { content.style.display = "block"; } }); } </script> </body> </html>