anssi

BP28(R08)

security_patches_up_to_dateEnsure Software Patches Installed

BP28(R1)

grub2_nosmap_argument_absentEnsure SMAP is not disabled during boot
grub2_nosmep_argument_absentEnsure SMEP is not disabled during boot
package_telnetd_removedUninstall the telnet server

BP28(R10)

prefer_64bit_osPrefer to use a 64-bit Operating System when supported

BP28(R11)

grub2_enable_iommu_forceIOMMU configuration directive

BP28(R12)

partition_for_homeEnsure /home Located On Separate Partition
partition_for_srvEnsure /srv Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
sysctl_net_ipv4_conf_all_accept_localDisable Accepting Packets Routed Between Local Interfaces
sysctl_net_ipv4_conf_all_arp_filterConfigure ARP filtering for All IPv4 Interfaces
sysctl_net_ipv4_conf_all_arp_ignoreConfigure Response Mode of ARP Requests for All IPv4 Interfaces
sysctl_net_ipv4_conf_all_route_localnetPrevent Routing External Traffic to Local Loopback on All IPv4 Interfaces
sysctl_net_ipv4_conf_all_shared_mediaConfigure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces
sysctl_net_ipv4_conf_default_shared_mediaConfigure Sending and Accepting Shared Media Redirects by Default

BP28(R13)

file_permissions_systemmapVerify that local System.map file (if exists) is readable only by root
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

BP28(R15)

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_config_acpi_custom_methodDo not allow ACPI methods to be inserted/replaced at run time
kernel_config_compat_vdsoDisable the 32-bit vDSO
kernel_config_debug_fsDisable kernel debugfs
kernel_config_devkmemDisable /dev/kmem virtual device support
kernel_config_proc_kcoreDisable support for /proc/kkcore
kernel_config_retpolineAvoid speculative indirect branches in kernel
kernel_config_security_dmesg_restrictRestrict unprivileged access to the kernel syslog
kernel_config_x86_vsyscall_emulationDisable x86 vsyscall emulation

BP28(R16)

kernel_config_debug_credentialsEnable checks on credential management
kernel_config_debug_listEnable checks on linked list manipulation
kernel_config_debug_notifiersEnable checks on notifier call chains
kernel_config_debug_sgEnable checks on scatter-gather (SG) table operations

BP28(R17)

kernel_config_compat_brkDisable compatibility with brk()
kernel_config_page_poisoning_no_sanityEnable poison without sanity check
kernel_config_page_poisoning_zeroUse zero for poisoning instead of debugging value
kernel_config_slub_debugEnable SLUB debugging support

BP28(R18)

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
kernel_config_module_sigEnable module signature verification
kernel_config_module_sig_allEnable automatic signing of all modules
kernel_config_module_sig_forceRequire modules to be validly signed
kernel_config_module_sig_hashSpecify the hash to use when signing modules
kernel_config_module_sig_keySpecify module signing key to use
kernel_config_module_sig_sha512Sign kernel modules with SHA-512

BP28(R19)

kernel_config_bugEnable support for BUG()
kernel_config_panic_on_oopsKernel panic oops
kernel_config_panic_timeoutKernel panic timeout
no_direct_root_loginsDirect root Logins Not Allowed
sshd_disable_root_loginDisable SSH Root Login

BP28(R20)

kernel_config_seccompEnable seccomp to safely compute untrusted bytecode
kernel_config_seccomp_filterEnable use of Berkeley Packet Filter with seccomp
kernel_config_securityEnable different security models
kernel_config_security_writable_hooksDisable mutable hooks
kernel_config_security_yamaEnable Yama support

BP28(R22)

kernel_config_ipv6Disable the IPv6 protocol
kernel_config_syn_cookiesEnable TCP/IP syncookie support

BP28(R23)

kernel_config_binfmt_miscDisable kernel support for MISC binaries
kernel_config_hibernationDisable hibernation
kernel_config_kexecDisable kexec system call
kernel_config_legacy_ptysDisable legacy (BSD) PTY support
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

BP28(R25)

kernel_config_default_mmap_min_addrConfigure low address space to protect from user allocation
kernel_config_ia32_emulationDisable IA32 emulation
kernel_config_page_table_isolationRemove the kernel mapping in user mode
kernel_config_randomize_baseRandomize the address of the kernel image (KASLR)
kernel_config_randomize_memoryRandomize the kernel memory sections

BP28(R27)

kernel_config_randomize_baseRandomize the address of the kernel image (KASLR)
kernel_config_unmap_kernel_at_el0Unmap kernel when running in userspace (aka KAISER)

BP28(R29)

sshd_set_idle_timeoutSet SSH Client Alive Interval

BP28(R32)

sshd_set_keepaliveSet SSH Client Alive Count Max

BP28(R33)

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

BP28(R35)

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile

BP28(R36)

file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_shadowVerify User Who Owns shadow File
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

BP28(R37)

file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized

BP28(R38)

file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized

BP28(R39)

accounts_polyinstantiated_tmpConfigure Polyinstantiation of /tmp Directories
accounts_polyinstantiated_var_tmpConfigure Polyinstantiation of /var/tmp Directories

BP28(R4)

selinux_stateEnsure SELinux State is Enforcing

BP28(R40)

dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist

BP28(R43)

partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

BP28(R46)

package_syslogng_installedEnsure syslog-ng is Installed
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
service_syslogng_enabledEnable syslog-ng Service

BP28(R47)

partition_for_var_logEnsure /var/log Located On Separate Partition

BP28(R49)

postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account

BP28(R5)

package_syslogng_installedEnsure syslog-ng is Installed
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
service_syslogng_enabledEnable syslog-ng Service
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

BP28(R50)

package_cron_installedInstall the cron service

BP28(R58)

sudo_add_noexecEnsure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC
sudo_add_requirettyEnsure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty
sudo_add_use_ptyEnsure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

BP28(R59)

sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

BP28(R61)

sudoers_no_command_negationDon't define allowed commands in sudoers by means of exclusion

BP28(R63)

sudoers_explicit_command_argsExplicit arguments in sudo specifications

BP28(R66)

selinux_stateEnsure SELinux State is Enforcing

BP28(R7)

rsyslog_remote_loghostEnsure Logs Sent To Remote Host

BP28(R71)

chronyd_specify_remote_serverA remote time server for Chrony is configured
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
package_chrony_installedThe Chrony package is installed
package_logrotate_installedEnsure logrotate is Installed

BP28(R73)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

BP28(R8)

grub2_l1tf_argumentConfigure L1 Terminal Fault mitigations
grub2_mce_argumentForce kernel panic on uncorrected MCEs
grub2_rng_core_default_quality_argumentConfigure the confidence in TPM for entropy
grub2_slab_nomerge_argumentDisable merging of slabs with similar size
grub2_spec_store_bypass_disable_argumentConfigure Speculative Store Bypass Mitigation
grub2_spectre_v2_argumentEnforce Spectre v2 mitigation

BP28(R9)

sysctl_kernel_panic_on_oopsKernel panic on oops

NT007(R02)

package_telnetd-ssl_removedUninstall the ssl compliant telnet server

NT007(R03)

package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd_removedUninstall the telnet server

NT007(R1)

sshd_allow_only_protocol2Allow Only SSH Protocol 2

NT007(R17)

sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords

NT007(R21)

sshd_disable_root_loginDisable SSH Root Login

NT012(R03)

package_ntp_installedInstall the ntp service
service_ntp_enabledEnable the NTP Daemon

NT12(R18)

ensure_logrotate_activatedEnsure Logrotate Runs Periodically
package_logrotate_installedEnsure logrotate is Installed

NT12(R5)

rsyslog_remote_loghostEnsure Logs Sent To Remote Host

NT28(R43)

rsyslog_remote_loghostEnsure Logs Sent To Remote Host

cis-csc

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_openssh-server_installedInstall the OpenSSH Server Package
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
security_patches_up_to_dateEnsure Software Patches Installed
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_hashesVerify File Hashes with RPM
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

security_patches_up_to_dateEnsure Software Patches Installed
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_libreswan_installedInstall libreswan Package
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

cjis

5.10.4.1

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
security_patches_up_to_dateEnsure Software Patches Installed

5.4.1.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
service_auditd_enabledEnable auditd Service

5.5.2

account_unique_nameEnsure All Accounts on the System Have Unique Names
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_empty_passwordsPrevent Login to Accounts With Empty Password

5.5.2.2

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File

5.5.6

disable_host_authDisable Host-Based Authentication
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

5.6.2.1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

5.6.2.1.1

accounts_minimum_age_login_defsSet Password Minimum Age

cobit5

APO01.06

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

APO07.06

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

APO08.04

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

APO10.01

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

APO10.03

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

APO10.04

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

APO10.05

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

APO11.04

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

APO11.06

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

APO12.01

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

APO12.02

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

APO12.03

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

APO12.04

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

APO12.06

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

APO13.01

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

APO13.02

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

BAI03.01

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

BAI03.02

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

BAI03.03

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

BAI03.05

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

BAI03.08

sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

BAI03.10

security_patches_up_to_dateEnsure Software Patches Installed

BAI04.04

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

BAI06.01

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM

BAI07.04

sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

BAI08.02

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

BAI08.04

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

BAI10.01

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

BAI10.02

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

BAI10.03

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

BAI10.05

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

DSS01.03

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

DSS01.04

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

DSS01.05

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)

DSS02.02

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
service_auditd_enabledEnable auditd Service

DSS02.04

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

DSS02.05

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DSS02.07

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

DSS03.01

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

DSS03.04

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DSS03.05

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

DSS04.05

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DSS05.01

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

DSS05.02

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
security_patches_up_to_dateEnsure Software Patches Installed
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

DSS05.03

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

DSS05.04

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_libreswan_installedInstall libreswan Package
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_openssh-server_installedInstall the OpenSSH Server Package
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

DSS05.05

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

DSS05.06

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

DSS05.07

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_openssh-server_installedInstall the OpenSSH Server Package
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

DSS05.10

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

DSS06.01

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DSS06.02

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

DSS06.03

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

DSS06.06

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

DSS06.10

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

MEA01.01

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

MEA01.02

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

MEA01.03

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

MEA01.04

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

MEA01.05

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

MEA02.01

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

MEA03.03

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

MEA03.04

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

cui

3.1.1

accounts_no_uid_except_zeroVerify Only Root Has UID 0
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login

3.1.11

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

3.1.12

disable_host_authDisable Host-Based Authentication
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_use_priv_separationEnable Use of Privilege Separation

3.1.13

file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

3.1.2

selinux_stateEnsure SELinux State is Enforcing

3.1.20

sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

3.1.5

accounts_no_uid_except_zeroVerify Only Root Has UID 0
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login

3.1.6

no_direct_root_loginsDirect root Logins Not Allowed

3.1.7

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

3.1.8

audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share

3.1.9

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

3.13.10

file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files

3.3.1

audit_rules_immutableMake the auditd Configuration Immutable
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
service_auditd_enabledEnable auditd Service

3.3.2

service_auditd_enabledEnable auditd Service

3.3.6

service_auditd_enabledEnable auditd Service

3.3.8

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

3.4.1

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

3.4.3

audit_rules_immutableMake the auditd Configuration Immutable

3.4.6

service_autofs_disabledDisable the Automounter

3.4.8

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed

3.5.10

accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

3.5.4

sshd_allow_only_protocol2Allow Only SSH Protocol 2

3.5.6

accounts_maximum_age_login_defsSet Password Maximum Age

3.5.7

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

3.5.8

accounts_minimum_age_login_defsSet Password Minimum Age
accounts_password_warn_age_login_defsSet Password Warning Age

3.7.2

selinux_stateEnsure SELinux State is Enforcing

disa

CCI-000018

audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

CCI-000044

account_passwords_pam_faillock_auditAccount Lockouts Must Be Logged
account_passwords_pam_faillock_dirAccount Lockouts Must Persist
accounts_passwords_pam_faillock_auditAccount Lockouts Must Be Logged

CCI-000048

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

CCI-000050

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

CCI-000052

display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
sshd_print_last_logEnable SSH Print Last Log

CCI-000054

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

CCI-000067

sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

CCI-000068

sshd_rekey_limitForce frequent session key renegotiation

CCI-000126

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
service_auditd_enabledEnable auditd Service

CCI-000130

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000131

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000132

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000133

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000134

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000135

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000136

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

CCI-000139

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
postfix_client_configure_mail_alias_postmasterConfigure System to Forward All Mail From Postmaster to The Root Account

CCI-000140

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size

CCI-000154

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000158

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000160

chronyd_specify_remote_serverA remote time server for Chrony is configured
package_ntp_installedInstall the ntp service
service_ntp_enabledEnable the NTP Daemon

CCI-000162

audit_rules_immutableMake the auditd Configuration Immutable
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

CCI-000163

audit_rules_immutableMake the auditd Configuration Immutable
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

CCI-000164

audit_rules_immutableMake the auditd Configuration Immutable
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

CCI-000169

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000171

file_groupownership_audit_configurationAudit Configuration Files Must Be Owned By Group root
file_ownership_audit_configurationAudit Configuration Files Must Be Owned By Root

CCI-000172

audit_privileged_commands_initEnsure auditd Collects Information on the Use of Privileged Commands - init
audit_privileged_commands_poweroffEnsure auditd Collects Information on the Use of Privileged Commands - poweroff
audit_privileged_commands_rebootEnsure auditd Collects Information on the Use of Privileged Commands - reboot
audit_privileged_commands_shutdownEnsure auditd Collects Information on the Use of Privileged Commands - shutdown
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-000196

no_netrc_filesVerify No netrc Files Exist

CCI-000197

sshd_allow_only_protocol2Allow Only SSH Protocol 2

CCI-000198

accounts_minimum_age_login_defsSet Password Minimum Age

CCI-000199

accounts_maximum_age_login_defsSet Password Maximum Age

CCI-000205

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

CCI-000225

file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable

CCI-000318

sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication

CCI-000366

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
auditd_local_eventsInclude Local Events in Audit Logs
auditd_log_formatResolve information before writing to audit logs
coredump_disable_backtracesDisable core dump backtraces
coredump_disable_storageDisable storing core dump
disable_host_authDisable Host-Based Authentication
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
fapolicyd_prevent_home_folder_accessfapolicyd Must be Configured to Limit Access to Users Home Folders
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_logrotate_installedEnsure logrotate is Installed
package_rsyslog_installedEnsure rsyslog is Installed
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
security_patches_up_to_dateEnsure Software Patches Installed
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_rsyslog_enabledEnable rsyslog Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_disable_x11_forwardingDisable X11 Forwarding
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CCI-000368

sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication

CCI-000381

kernel_module_tipc_disabledDisable TIPC Support
kernel_module_uvcvideo_disabledDisable the uvcvideo module
service_atd_disabledDisable At Service (atd)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)

CCI-000382

service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)

CCI-000764

gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group

CCI-000765

sshd_enable_pubkey_authEnable Public Key Authentication

CCI-000766

sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_enable_pubkey_authEnable Public Key Authentication

CCI-000767

sshd_enable_pubkey_authEnable Public Key Authentication

CCI-000768

sshd_enable_pubkey_authEnable Public Key Authentication

CCI-000770

account_unique_nameEnsure All Accounts on the System Have Unique Names
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sshd_disable_root_loginDisable SSH Root Login

CCI-000778

service_autofs_disabledDisable the Automounter

CCI-000804

account_unique_nameEnsure All Accounts on the System Have Unique Names

CCI-000877

sshd_enable_pamEnable PAM

CCI-000879

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

CCI-001084

selinux_stateEnsure SELinux State is Enforcing

CCI-001090

dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set

CCI-001130

package_libreswan_installedInstall libreswan Package

CCI-001131

package_libreswan_installedInstall libreswan Package

CCI-001133

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

CCI-001208

partition_for_homeEnsure /home Located On Separate Partition

CCI-001227

security_patches_up_to_dateEnsure Software Patches Installed

CCI-001233

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

CCI-001263

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

CCI-001311

package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

CCI-001312

package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

CCI-001314

file_groupowner_var_logVerify Group Who Owns /var/log Directory
file_groupowner_var_log_messagesVerify Group Who Owns /var/log/messages File
file_groupowner_var_log_syslogVerify Group Who Owns /var/log/syslog File
file_owner_var_logVerify User Who Owns /var/log Directory
file_owner_var_log_messagesVerify User Who Owns /var/log/messages File
file_owner_var_log_syslogVerify User Who Owns /var/log/syslog File
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_var_logVerify Permissions on /var/log Directory
file_permissions_var_log_messagesVerify Permissions on /var/log/messages File
file_permissions_var_log_syslogVerify Permissions on /var/log/syslog File
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

CCI-001343

auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space

CCI-001348

rsyslog_remote_loghostEnsure Logs Sent To Remote Host

CCI-001384

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

CCI-001385

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

CCI-001386

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

CCI-001387

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

CCI-001388

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

CCI-001403

audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

CCI-001436

no_rsh_trust_filesRemove Rsh Trust Files

CCI-001453

configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy

CCI-001464

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001487

audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001493

rpm_verify_permissionsVerify and Correct File Permissions with RPM

CCI-001494

rpm_verify_permissionsVerify and Correct File Permissions with RPM

CCI-001495

dir_ownership_binary_dirsVerify that System Executable Have Root Ownership
dir_permissions_binary_dirsVerify that System Executable Directories Have Restrictive Permissions
rpm_verify_permissionsVerify and Correct File Permissions with RPM

CCI-001496

rpm_verify_permissionsVerify and Correct File Permissions with RPM

CCI-001499

dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions

CCI-001551

sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

CCI-001557

service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

CCI-001665

service_systemd-journald_enabledEnable systemd-journald Service

CCI-001749

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM

CCI-001764

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

CCI-001812

sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication

CCI-001813

sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication

CCI-001814

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication

CCI-001849

partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

CCI-001851

auditd_name_formatSet type of computer node name logging in audit logs
auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
package_audit-audispd-plugins_installedEnsure the default plugins for the audit dispatcher are Installed
rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

CCI-001855

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

CCI-001875

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001876

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001877

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001878

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001879

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001880

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001881

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001882

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001889

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001891

chronyd_server_directiveEnsure Chrony is only configured with the server directive
chronyd_specify_remote_serverA remote time server for Chrony is configured

CCI-001914

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

CCI-001958

service_autofs_disabledDisable the Automounter

CCI-002038

disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

CCI-002130

audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

CCI-002165

selinux_stateEnsure SELinux State is Enforcing
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

CCI-002223

file_groupowner_backup_etc_groupVerify Group Who Owns Backup group File
file_groupowner_backup_etc_gshadowVerify Group Who Owns Backup gshadow File
file_groupowner_backup_etc_passwdVerify Group Who Owns Backup passwd File
file_owner_backup_etc_groupVerify User Who Owns Backup group File
file_owner_backup_etc_gshadowVerify User Who Owns Backup gshadow File
file_owner_backup_etc_passwdVerify User Who Owns Backup passwd File
file_owner_backup_etc_shadowVerify Group Who Owns Backup shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_permissions_backup_etc_groupVerify Permissions on Backup group File
file_permissions_backup_etc_gshadowVerify Permissions on Backup gshadow File
file_permissions_backup_etc_passwdVerify Permissions on Backup passwd File
file_permissions_backup_etc_shadowVerify Permissions on Backup shadow File
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File

CCI-002234

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

CCI-002314

service_ufw_enabledVerify ufw Enabled

CCI-002361

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

CCI-002418

package_openssh-server_installedInstall the OpenSSH Server Package

CCI-002420

package_openssh-server_installedInstall the OpenSSH Server Package

CCI-002421

package_openssh-server_installedInstall the OpenSSH Server Package

CCI-002422

package_openssh-server_installedInstall the OpenSSH Server Package

CCI-002696

selinux_stateEnsure SELinux State is Enforcing

CCI-002824

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CCI-002884

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

hipaa

164.308(a)(1)(ii)(B)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins

164.308(a)(1)(ii)(D)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

164.308(a)(3)

selinux_stateEnsure SELinux State is Enforcing
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

164.308(a)(3)(i)

service_autofs_disabledDisable the Automounter

164.308(a)(3)(ii)(A)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
service_autofs_disabledDisable the Automounter

164.308(a)(4)

selinux_stateEnsure SELinux State is Enforcing
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

164.308(a)(4)(i)

configure_crypto_policyConfigure System Cryptography Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
disable_host_authDisable Host-Based Authentication
no_rsh_trust_filesRemove Rsh Trust Files
package_cron_installedInstall the cron service
service_cron_enabledEnable cron Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

164.308(a)(5)(ii)(B)

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

164.308(a)(5)(ii)(C)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_auditd_enabledEnable auditd Service

164.308(a)(6)(ii)

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

164.308(a)(7)(i)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins

164.308(a)(7)(ii)(A)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins

164.308(a)(8)

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

164.308(b)(1)

configure_crypto_policyConfigure System Cryptography Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
disable_host_authDisable Host-Based Authentication
no_rsh_trust_filesRemove Rsh Trust Files
package_cron_installedInstall the cron service
service_cron_enabledEnable cron Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

164.308(b)(3)

configure_crypto_policyConfigure System Cryptography Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
disable_host_authDisable Host-Based Authentication
no_rsh_trust_filesRemove Rsh Trust Files
package_cron_installedInstall the cron service
service_cron_enabledEnable cron Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

164.310(a)(1)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins

164.310(a)(2)(i)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins

164.310(a)(2)(ii)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins

164.310(a)(2)(iii)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins

164.310(a)(2)(iv)

audit_rules_immutableMake the auditd Configuration Immutable
service_auditd_enabledEnable auditd Service

164.310(b)

disable_host_authDisable Host-Based Authentication
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_rsh_trust_filesRemove Rsh Trust Files
package_cron_installedInstall the cron service
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_cron_enabledEnable cron Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

164.310(c)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

164.310(d)(1)

no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
service_autofs_disabledDisable the Automounter

164.310(d)(2)

service_autofs_disabledDisable the Automounter

164.310(d)(2)(iii)

audit_rules_immutableMake the auditd Configuration Immutable
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
service_auditd_enabledEnable auditd Service

164.312(a)

selinux_stateEnsure SELinux State is Enforcing
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

164.312(a)(1)

service_autofs_disabledDisable the Automounter

164.312(a)(2)(i)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File

164.312(a)(2)(ii)

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
package_rsyslog_installedEnsure rsyslog is Installed
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
service_rsyslog_enabledEnable rsyslog Service

164.312(a)(2)(iv)

service_autofs_disabledDisable the Automounter

164.312(b)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter

164.312(c)(1)

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

164.312(c)(2)

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

164.312(d)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File

164.312(e)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
selinux_stateEnsure SELinux State is Enforcing
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

164.312(e)(1)

configure_crypto_policyConfigure System Cryptography Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
disable_host_authDisable Host-Based Authentication
no_rsh_trust_filesRemove Rsh Trust Files
package_cron_installedInstall the cron service
service_cron_enabledEnable cron Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

164.312(e)(2)(i)

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

164.312(e)(2)(ii)

configure_crypto_policyConfigure System Cryptography Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
disable_host_authDisable Host-Based Authentication
no_rsh_trust_filesRemove Rsh Trust Files
package_cron_installedInstall the cron service
service_cron_enabledEnable cron Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

164.314(a)(2)(i)(C)

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

164.314(a)(2)(iii)

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

isa-62443-2009

4.2.3

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

4.2.3.10

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
service_auditd_enabledEnable auditd Service

4.2.3.12

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

4.2.3.4

selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)

4.2.3.7

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

4.2.3.9

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

4.3.2.6.7

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

4.3.3.2.2

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

4.3.3.3.9

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

4.3.3.4

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)

4.3.3.5.1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.5.2

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.5.3

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.5.4

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.5.5

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.5.6

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.5.7

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.5.8

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.2

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.3

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.4

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.5

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.6

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.7

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.8

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.6.9

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.7.1

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.7.2

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.7.3

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.3.7.4

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.4.3.2

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.4.3.3

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

4.3.4.4.4

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM

4.3.4.4.7

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

4.3.4.5.2

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

4.3.4.5.5

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

4.3.4.5.6

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

4.3.4.5.7

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

4.3.4.5.8

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

4.3.4.5.9

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

4.4.2.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

4.4.2.2

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

4.4.2.4

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

4.4.3.2

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

4.4.3.3

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

4.4.3.4

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

isa-62443-2013

SR 1.1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.10

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.11

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.12

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.13

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.2

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.3

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.4

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.5

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.6

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.7

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.8

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 1.9

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 2.1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 2.10

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

SR 2.11

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

SR 2.12

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

SR 2.2

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 2.3

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 2.4

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 2.5

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 2.6

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 2.7

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

SR 2.8

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

SR 2.9

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

SR 3.1

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_hashesVerify File Hashes with RPM
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SR 3.3

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
rpm_verify_hashesVerify File Hashes with RPM

SR 3.4

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM

SR 3.5

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SR 3.8

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_hashesVerify File Hashes with RPM
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SR 3.9

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

SR 4.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SR 4.2

package_openssh-server_installedInstall the OpenSSH Server Package

SR 4.3

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SR 5.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SR 5.2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

SR 5.3

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SR 6.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

SR 6.2

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

SR 7.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SR 7.2

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

SR 7.6

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

ism

0418

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_password_warn_age_login_defsSet Password Warning Age
configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
sshd_disable_gssapi_authDisable GSSAPI Authentication

0421

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

0422

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

0431

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

0487

sshd_allow_only_protocol2Allow Only SSH Protocol 2

0582

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

0584

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

0586

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

05885

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

0846

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

0957

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

0974

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

0988

chronyd_specify_remote_serverA remote time server for Chrony is configured
package_chrony_installedThe Chrony package is installed
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_chronyd_enabledThe Chronyd service is enabled

1055

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_password_warn_age_login_defsSet Password Warning Age
configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
sshd_disable_gssapi_authDisable GSSAPI Authentication

1173

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1401

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1402

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_password_warn_age_login_defsSet Password Warning Age
configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
sshd_disable_gssapi_authDisable GSSAPI Authentication

1405

chronyd_specify_remote_serverA remote time server for Chrony is configured
package_chrony_installedThe Chrony package is installed
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_chronyd_enabledThe Chronyd service is enabled

1410

accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

1446

configure_crypto_policyConfigure System Cryptography Policy

1449

sshd_allow_only_protocol2Allow Only SSH Protocol 2

1504

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1505

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1506

sshd_allow_only_protocol2Allow Only SSH Protocol 2

1546

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1557

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1558

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1559

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1560

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

1561

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
disable_host_authDisable Host-Based Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_set_max_auth_triesSet SSH authentication attempt limit

iso27001-2013

A.10.1.1

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.11.1.4

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.11.1.5

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.11.2.1

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.11.2.4

audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
package_libreswan_installedInstall libreswan Package
rpm_verify_hashesVerify File Hashes with RPM

A.11.2.6

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

A.11.2.9

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

A.12.1.1

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

A.12.1.2

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

A.12.1.3

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

A.12.1.4

sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

A.12.2.1

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM

A.12.4.1

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

A.12.4.2

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

A.12.4.3

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

A.12.4.4

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

A.12.5.1

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

A.12.6.1

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

A.12.6.2

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

A.12.7.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

A.13.1.1

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_use_priv_separationEnable Use of Privilege Separation

A.13.1.2

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

A.13.1.3

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.13.2.1

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.13.2.2

selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)

A.13.2.3

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.13.2.4

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.14.1.1

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

A.14.1.2

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.14.1.3

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.14.2.1

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

A.14.2.2

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

A.14.2.3

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
security_patches_up_to_dateEnsure Software Patches Installed
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

A.14.2.4

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

A.14.2.5

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

A.14.2.7

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

A.14.2.8

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

A.15.1.1

audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
package_libreswan_installedInstall libreswan Package

A.15.2.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_libreswan_installedInstall libreswan Package
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

A.15.2.2

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

A.16.1.1

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

A.16.1.2

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

A.16.1.3

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

A.16.1.4

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

A.16.1.5

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

A.16.1.6

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

A.16.1.7

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

A.17.2.1

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

A.18.1.4

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.18.2.2

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

A.18.2.3

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

A.6.1.2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

A.6.1.3

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

A.6.1.5

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

A.6.2.1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

A.6.2.2

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

A.7.1.1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

A.7.1.2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.7.3.1

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.8.2.1

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

A.8.2.2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.8.2.3

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.8.3.1

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

A.8.3.3

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

A.9.1.1

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

A.9.1.2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_openssh-server_installedInstall the OpenSSH Server Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

A.9.2.1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
disable_host_authDisable Host-Based Authentication
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.9.2.2

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.9.2.3

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.9.2.4

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.9.2.6

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.9.3.1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.9.4.1

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

A.9.4.2

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.9.4.3

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

A.9.4.4

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

A.9.4.5

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

Clause 16.1.2

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

Clause 7.4

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

nerc-cip

CIP-002-5 R1.1

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-002-5 R1.2

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-003-8 R1.3

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
no_netrc_filesVerify No netrc Files Exist

CIP-003-8 R3

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
no_netrc_filesVerify No netrc Files Exist

CIP-003-8 R3.1

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
no_netrc_filesVerify No netrc Files Exist

CIP-003-8 R3.2

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
no_netrc_filesVerify No netrc Files Exist

CIP-003-8 R3.3

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
no_netrc_filesVerify No netrc Files Exist

CIP-003-8 R4

service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

CIP-003-8 R4.2

configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
configure_crypto_policyConfigure System Cryptography Policy
configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
rpm_verify_permissionsVerify and Correct File Permissions with RPM
sshd_allow_only_protocol2Allow Only SSH Protocol 2

CIP-003-8 R5

service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

CIP-003-8 R5.1.1

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-003-8 R5.2

directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing

CIP-003-8 R5.3

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-003-8 R6

dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_permissionsVerify and Correct File Permissions with RPM

CIP-004-6 4.1

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-004-6 4.2

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-004-6 R2.2.2

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

CIP-004-6 R2.2.3

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-004-6 R2.2.4

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-004-6 R2.3

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-004-6 R3

service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

CIP-004-6 R3.3

auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
package_audit_installedEnsure the audit Subsystem is Installed
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service

CIP-004-6 R4

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-005-6 R1

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-005-6 R1.1

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-005-6 R1.2

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-007-3 R.1.3

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

CIP-007-3 R2.1

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

CIP-007-3 R2.2

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

CIP-007-3 R2.3

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

CIP-007-3 R3

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-007-3 R3.1

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-007-3 R4

ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_permissionsVerify and Correct File Permissions with RPM

CIP-007-3 R4.1

ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_permissionsVerify and Correct File Permissions with RPM

CIP-007-3 R4.2

ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_permissionsVerify and Correct File Permissions with RPM

CIP-007-3 R5

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

CIP-007-3 R5.1

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
configure_crypto_policyConfigure System Cryptography Policy
configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-007-3 R5.1.1

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

CIP-007-3 R5.1.2

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-007-3 R5.1.3

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-007-3 R5.2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

CIP-007-3 R5.2.1

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-007-3 R5.2.3

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-007-3 R5.3.1

accounts_no_uid_except_zeroVerify Only Root Has UID 0
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

CIP-007-3 R5.3.2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

CIP-007-3 R5.3.3

accounts_no_uid_except_zeroVerify Only Root Has UID 0
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

CIP-007-3 R6.5

auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
package_audit_installedEnsure the audit Subsystem is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service

CIP-007-3 R7.1

configure_crypto_policyConfigure System Cryptography Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

CIP-007-3 R8.4

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-009-6 R.1.1

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

CIP-009-6 R4

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

nist

AC-10

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

AC-12

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

AC-17(1)

sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

AC-17(2)

configure_crypto_policyConfigure System Cryptography Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

AC-17(a)

configure_crypto_policyConfigure System Cryptography Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
disable_host_authDisable Host-Based Authentication
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_set_loglevel_infoSet LogLevel to INFO
sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
sshd_use_priv_separationEnable Use of Privilege Separation

AC-2(4)

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

AC-2(5)

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

AC-2(7)(b)

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

AC-2(g)

service_auditd_enabledEnable auditd Service

AC-3

disable_host_authDisable Host-Based Authentication
selinux_stateEnsure SELinux State is Enforcing
sshd_limit_user_accessLimit Users' SSH Access

AC-3(3)(a)

selinux_stateEnsure SELinux State is Enforcing

AC-4

service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

AC-6

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
restrict_serial_port_loginsRestrict Serial Port Root Logins
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

AC-6 (1)

file_groupowner_backup_etc_groupVerify Group Who Owns Backup group File
file_groupowner_backup_etc_gshadowVerify Group Who Owns Backup gshadow File
file_groupowner_backup_etc_passwdVerify Group Who Owns Backup passwd File
file_owner_backup_etc_groupVerify User Who Owns Backup group File
file_owner_backup_etc_gshadowVerify User Who Owns Backup gshadow File
file_owner_backup_etc_passwdVerify User Who Owns Backup passwd File
file_owner_backup_etc_shadowVerify Group Who Owns Backup shadow File
file_permissions_backup_etc_groupVerify Permissions on Backup group File
file_permissions_backup_etc_gshadowVerify Permissions on Backup gshadow File
file_permissions_backup_etc_passwdVerify Permissions on Backup passwd File
file_permissions_backup_etc_shadowVerify Permissions on Backup shadow File

AC-6(1)

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

AC-6(2)

sshd_disable_root_loginDisable SSH Root Login

AC-6(5)

accounts_no_uid_except_zeroVerify Only Root Has UID 0

AC-6(9)

audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
directory_access_var_log_auditRecord Access Events to Audit Log Directory
service_auditd_enabledEnable auditd Service

AC-7 (a)

account_passwords_pam_faillock_auditAccount Lockouts Must Be Logged
accounts_passwords_pam_faillock_auditAccount Lockouts Must Be Logged

AC-7 (ia)

account_passwords_pam_faillock_dirAccount Lockouts Must Persist

AC-7(a)

package_audit_installedEnsure the audit Subsystem is Installed

AC-7(b)

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs

AC-8(a)

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

AC-8(c)

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

AC-9

display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
sshd_print_last_logEnable SSH Print Last Log

AC-9(1)

display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
sshd_print_last_logEnable SSH Print Last Log

AU-10

service_auditd_enabledEnable auditd Service

AU-11

auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained

AU-12(2)

package_audit_installedEnsure the audit Subsystem is Installed

AU-12(c)

audit_privileged_commands_initEnsure auditd Collects Information on the Use of Privileged Commands - init
audit_privileged_commands_poweroffEnsure auditd Collects Information on the Use of Privileged Commands - poweroff
audit_privileged_commands_rebootEnsure auditd Collects Information on the Use of Privileged Commands - reboot
audit_privileged_commands_shutdownEnsure auditd Collects Information on the Use of Privileged Commands - shutdown
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
directory_access_var_log_auditRecord Access Events to Audit Log Directory
service_auditd_enabledEnable auditd Service

AU-14

package_audit_installedEnsure the audit Subsystem is Installed

AU-14(1)

service_auditd_enabledEnable auditd Service

AU-2(a)

package_audit_installedEnsure the audit Subsystem is Installed

AU-2(d)

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
directory_access_var_log_auditRecord Access Events to Audit Log Directory
service_auditd_enabledEnable auditd Service

AU-3

auditd_log_formatResolve information before writing to audit logs
auditd_name_formatSet type of computer node name logging in audit logs
service_auditd_enabledEnable auditd Service

AU-4

partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

AU-4(1)

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

AU-5(1)

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

AU-5(2)

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

AU-5(4)

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

AU-5(a)

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
postfix_client_configure_mail_alias_postmasterConfigure System to Forward All Mail From Postmaster to The Root Account

AU-5(b)

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

AU-5.1(ii)

postfix_client_configure_mail_alias_postmasterConfigure System to Forward All Mail From Postmaster to The Root Account

AU-6(3)

rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

AU-6(4)

rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

AU-7(1)

package_audit_installedEnsure the audit Subsystem is Installed

AU-7(2)

package_audit_installedEnsure the audit Subsystem is Installed

AU-8(1)(a)

chronyd_specify_remote_serverA remote time server for Chrony is configured
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon

AU-8(2)

ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers

AU-9

directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
selinux_stateEnsure SELinux State is Enforcing

AU-9(2)

rsyslog_remote_loghostEnsure Logs Sent To Remote Host

AU-9(3)

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

AU-9(4)

file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

CA-3(5)

service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets

CM-11(a)

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration

CM-11(b)

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration

CM-3(6)

service_sshd_disabledDisable SSH Server If Possible

CM-5

dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions

CM-5(3)

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed

CM-5(6)

dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions

CM-5(6).1

dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions

CM-6

auditd_freqSet number of records to cause an explicit flush to audit logs
auditd_local_eventsInclude Local Events in Audit Logs
auditd_log_formatResolve information before writing to audit logs
auditd_name_formatSet type of computer node name logging in audit logs
auditd_write_logsWrite Audit Logs to the Disk
coredump_disable_backtracesDisable core dump backtraces
coredump_disable_storageDisable storing core dump

CM-6 b

fapolicyd_prevent_home_folder_accessfapolicyd Must be Configured to Limit Access to Users Home Folders

CM-6(a)

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
avahi_disable_publishingDisable Avahi Publishing
chronyd_specify_remote_serverA remote time server for Chrony is configured
configure_crypto_policyConfigure System Cryptography Policy
configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
dhcp_server_minimize_served_infoMinimize Served Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_access_var_log_auditRecord Access Events to Audit Log Directory
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
no_rsh_trust_filesRemove Rsh Trust Files
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_audit_installedEnsure the audit Subsystem is Installed
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_openssh-server_installedInstall the OpenSSH Server Package
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
restrict_serial_port_loginsRestrict Serial Port Root Logins
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
security_patches_up_to_dateEnsure Software Patches Installed
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_set_loglevel_infoSet LogLevel to INFO
sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
sshd_use_priv_separationEnable Use of Privilege Separation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

CM-6(b)

no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
sshd_disable_x11_forwardingDisable X11 Forwarding

CM-6(c)

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

CM-6(d)

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

CM-6.1(iv)

no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords

CM-7 (5) (b)

kernel_module_uvcvideo_disabledDisable the uvcvideo module

CM-7 (a)

kernel_module_uvcvideo_disabledDisable the uvcvideo module

CM-7(a)

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

CM-7(b)

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
service_atd_disabledDisable At Service (atd)
service_autofs_disabledDisable the Automounter
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

IA-11

disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

IA-2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
sshd_disable_root_loginDisable SSH Root Login

IA-2(4)

service_sshd_disabledDisable SSH Server If Possible

IA-2(5)

sshd_disable_root_loginDisable SSH Root Login

IA-4(b)

accounts_no_uid_except_zeroVerify Only Root Has UID 0

IA-5(1)

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

IA-5(1)(a)

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
no_empty_passwordsPrevent Login to Accounts With Empty Password

IA-5(1)(c)

no_netrc_filesVerify No netrc Files Exist
sshd_allow_only_protocol2Allow Only SSH Protocol 2

IA-5(1)(d)

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_password_warn_age_login_defsSet Password Warning Age

IA-5(7)

no_netrc_filesVerify No netrc Files Exist

IA-5(c)

no_empty_passwordsPrevent Login to Accounts With Empty Password

IA-5(f)

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age

IA-5(h)

accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
no_netrc_filesVerify No netrc Files Exist

MA-4(6)

configure_crypto_policyConfigure System Cryptography Policy
configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
sshd_allow_only_protocol2Allow Only SSH Protocol 2

MP-7

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
service_autofs_disabledDisable the Automounter

SA-12

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration

SA-12(10)

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration

SC-10

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

SC-12

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed

SC-12(2)

configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
configure_crypto_policyConfigure System Cryptography Policy
configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy

SC-12(3)

configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
configure_crypto_policyConfigure System Cryptography Policy
configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed

SC-13

configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
configure_crypto_policyConfigure System Cryptography Policy
configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
sshd_allow_only_protocol2Allow Only SSH Protocol 2

SC-24

service_systemd-journald_enabledEnable systemd-journald Service

SC-30

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

SC-30(2)

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

SC-30(5)

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access

SC-5(2)

partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

SC-7(21)

selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

SC-7(23)

set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets

SI-11(a)

sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs

SI-11(b)

sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs

SI-2(5)

security_patches_up_to_dateEnsure Software Patches Installed

SI-2(c)

security_patches_up_to_dateEnsure Software Patches Installed

SI-4(23)

service_auditd_enabledEnable auditd Service

SI-7

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

SI-7(1)

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

SI-7(6)

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

nist-csf

DE.AE-1

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

DE.AE-2

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DE.AE-3

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

DE.AE-4

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DE.AE-5

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
service_auditd_enabledEnable auditd Service

DE.CM-1

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

DE.CM-3

accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

DE.CM-5

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DE.CM-6

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DE.CM-7

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

DE.DP-2

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DE.DP-3

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DE.DP-4

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

DE.DP-5

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

ID.AM-3

selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)

ID.RA-1

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
security_patches_up_to_dateEnsure Software Patches Installed

ID.SC-4

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
service_auditd_enabledEnable auditd Service
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

PR.AC-1

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

PR.AC-3

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_autofs_disabledDisable the Automounter
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

PR.AC-4

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
disable_host_authDisable Host-Based Authentication
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sshd_use_priv_separationEnable Use of Privilege Separation

PR.AC-5

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)

PR.AC-6

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
disable_host_authDisable Host-Based Authentication
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
selinux_stateEnsure SELinux State is Enforcing
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

PR.AC-7

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_minimum_age_login_defsSet Password Minimum Age
accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
accounts_password_warn_age_login_defsSet Password Warning Age
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
no_direct_root_loginsDirect root Logins Not Allowed
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_netrc_filesVerify No netrc Files Exist
service_autofs_disabledDisable the Automounter
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner
sshd_print_last_logEnable SSH Print Last Log
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

PR.DS-2

package_openssh-server_installedInstall the OpenSSH Server Package

PR.DS-4

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

PR.DS-5

accounts_no_uid_except_zeroVerify Only Root Has UID 0
audit_rules_immutableMake the auditd Configuration Immutable
dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
no_empty_passwordsPrevent Login to Accounts With Empty Password
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_openssh-server_installedInstall the OpenSSH Server Package
restrict_serial_port_loginsRestrict Serial Port Root Logins
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
securetty_root_login_console_onlyRestrict Virtual Console Root Logins
selinux_stateEnsure SELinux State is Enforcing
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_use_priv_separationEnable Use of Privilege Separation

PR.DS-6

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM

PR.DS-7

sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

PR.DS-8

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
rpm_verify_hashesVerify File Hashes with RPM

PR.IP-1

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

PR.IP-12

security_patches_up_to_dateEnsure Software Patches Installed

PR.IP-2

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

PR.IP-8

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

PR.MA-2

audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
package_libreswan_installedInstall libreswan Package

PR.PT-1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server
package_logrotate_installedEnsure logrotate is Installed
package_ntp_installedInstall the ntp service
package_rsyslog_installedEnsure rsyslog is Installed
package_syslogng_installedEnsure syslog-ng is Installed
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_permissionsVerify and Correct File Permissions with RPM
rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
selinux_stateEnsure SELinux State is Enforcing
service_auditd_enabledEnable auditd Service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon
service_rsyslog_enabledEnable rsyslog Service
service_syslogng_enabledEnable syslog-ng Service

PR.PT-2

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

PR.PT-3

avahi_disable_publishingDisable Avahi Publishing
dhcp_server_minimize_served_infoMinimize Served Information
disable_host_authDisable Host-Based Authentication
kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
kernel_module_rds_disabledDisable RDS Support
kernel_module_tipc_disabledDisable TIPC Support
mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
no_netrc_filesVerify No netrc Files Exist
no_rsh_trust_filesRemove Rsh Trust Files
package_bind_removedUninstall bind Package
package_cron_installedInstall the cron service
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_atd_disabledDisable At Service (atd)
service_cron_enabledEnable cron Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_limit_user_accessLimit Users' SSH Access
sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

PR.PT-4

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
no_rsh_trust_filesRemove Rsh Trust Files
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_inetutils-telnetd_removedUninstall the inet-based telnet server
package_libreswan_installedInstall libreswan Package
package_telnetd-ssl_removedUninstall the ssl compliant telnet server
package_telnetd_removedUninstall the telnet server
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
selinux_stateEnsure SELinux State is Enforcing
service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
service_auditd_enabledEnable auditd Service
service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
service_iptables_enabledVerify iptables Enabled
service_ntpdate_disabledDisable ntpdate Service (ntpdate)
service_qpidd_disabledDisable Apache Qpid (qpidd)
service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
sshd_allow_only_protocol2Allow Only SSH Protocol 2

RS.AN-1

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
service_auditd_enabledEnable auditd Service

RS.AN-4

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_immutableMake the auditd Configuration Immutable
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
service_auditd_enabledEnable auditd Service

RS.CO-2

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

RS.CO-3

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

ospp

FAU_GEN.1

auditd_freqSet number of records to cause an explicit flush to audit logs
auditd_local_eventsInclude Local Events in Audit Logs
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service
sshd_disable_root_loginDisable SSH Root Login

FAU_GEN.1.1.c

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
directory_access_var_log_auditRecord Access Events to Audit Log Directory
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

FAU_GEN.1.2

auditd_log_formatResolve information before writing to audit logs
auditd_name_formatSet type of computer node name logging in audit logs

FAU_STG.1

auditd_write_logsWrite Audit Logs to the Disk

FCS_CKM.1

configure_crypto_policyConfigure System Cryptography Policy

FCS_CKM.2

configure_crypto_policyConfigure System Cryptography Policy

FCS_COP.1(1)

configure_crypto_policyConfigure System Cryptography Policy

FCS_COP.1(2)

configure_crypto_policyConfigure System Cryptography Policy

FCS_COP.1(3)

configure_crypto_policyConfigure System Cryptography Policy

FCS_COP.1(4)

configure_crypto_policyConfigure System Cryptography Policy

FCS_IPSEC_EXT.1.4

configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy

FCS_IPSEC_EXT.1.6

configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy

FCS_SSHC_EXT.1

configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

FCS_SSHS_EXT.1

configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
package_openssh-server_installedInstall the OpenSSH Server Package

FCS_SSH_EXT.1

configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
package_openssh-server_installedInstall the OpenSSH Server Package

FCS_SSH_EXT.1.2

sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication

FCS_SSH_EXT.1.8

sshd_rekey_limitForce frequent session key renegotiation

FCS_TLSC_EXT.1

configure_crypto_policyConfigure System Cryptography Policy

FIA_UAU.1

disable_host_authDisable Host-Based Authentication
grub2_disable_recoveryDisable Recovery Booting
grub2_systemd_debug-shell_argument_absentEnsure debug-shell service is not enabled during boot
no_empty_passwordsPrevent Login to Accounts With Empty Password
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts

FIA_UAU.5

package_openssh-server_installedInstall the OpenSSH Server Package

FIA_X509_EXT.1

package_gnutls-utils_installedEnsure gnutls-utils is installed

FIA_X509_EXT.2

package_gnutls-utils_installedEnsure gnutls-utils is installed

FMT_MOF_EXT.1

security_patches_up_to_dateEnsure Software Patches Installed

FMT_SMF_EXT.1

coredump_disable_backtracesDisable core dump backtraces
coredump_disable_storageDisable storing core dump
kernel_module_tipc_disabledDisable TIPC Support
package_chrony_installedThe Chrony package is installed
package_nss-tools_installedEnsure nss-tools is installed
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

FPT_TUD_EXT.1

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed

FPT_TUD_EXT.2

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed

FTA_TAB.1

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

FTP_ITC_EXT.1

package_openssh-server_installedInstall the OpenSSH Server Package
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication

FTP_ITC_EXT.1.1

package_rsyslog_installedEnsure rsyslog is Installed

pcidss

Req-1.3

set_ipv6_loopback_trafficSet configuration for IPv6 loopback traffic
set_loopback_trafficSet configuration for loopback traffic

Req-10.1

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

Req-10.2.2

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

Req-10.2.3

audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information

Req-10.2.4

display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

Req-10.2.5

audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
sudo_add_use_ptyEnsure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
sudo_custom_logfileEnsure Sudo Logfile Exists - sudo logfile

Req-10.2.5.b

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

Req-10.2.7

audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)

Req-10.4

package_chrony_installedThe Chrony package is installed
package_ntp_installedInstall the ntp service
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon

Req-10.4.1

ntpd_specify_remote_serverSpecify a Remote NTP Server

Req-10.4.2.b

audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File

Req-10.4.3

chronyd_specify_remote_serverA remote time server for Chrony is configured
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server

Req-10.5.1

file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

Req-10.5.2

audit_rules_immutableMake the auditd Configuration Immutable
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

Req-10.5.3

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
package_audit-audispd-plugins_installedEnsure the default plugins for the audit dispatcher are Installed

Req-10.5.5

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_mac_modification_usr_shareRecord Events that Modify the System's Mandatory Access Controls in usr/share
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment

Req-10.7

auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
ensure_logrotate_activatedEnsure Logrotate Runs Periodically
package_logrotate_installedEnsure logrotate is Installed

Req-10.7.a

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

Req-11.4

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

Req-11.5

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

Req-2.2

configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy

Req-2.2.1

sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

Req-2.2.4

file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_root_loginDisable SSH Root Login
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

Req-3.2

coredump_disable_backtracesDisable core dump backtraces
coredump_disable_storageDisable storing core dump

Req-4.1

package_libreswan_installedInstall libreswan Package

Req-6.2

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
security_patches_up_to_dateEnsure Software Patches Installed

Req-8.1.1

account_unique_nameEnsure All Accounts on the System Have Unique Names
accounts_root_gid_zeroVerify Root Has A Primary GID 0

Req-8.1.8

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

Req-8.2.1

accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

Req-8.2.3

no_empty_passwordsPrevent Login to Accounts With Empty Password

Req-8.2.4

accounts_maximum_age_login_defsSet Password Maximum Age
accounts_password_warn_age_login_defsSet Password Warning Age

Req-8.5

accounts_no_uid_except_zeroVerify Only Root Has UID 0

Req-8.5.a

gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group

Req-8.7

file_groupowner_backup_etc_groupVerify Group Who Owns Backup group File
file_groupowner_backup_etc_gshadowVerify Group Who Owns Backup gshadow File
file_groupowner_backup_etc_passwdVerify Group Who Owns Backup passwd File
file_groupowner_backup_etc_shadowVerify User Who Owns Backup shadow File
file_owner_backup_etc_gshadowVerify User Who Owns Backup gshadow File

Req-8.7.c

file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_backup_etc_groupVerify User Who Owns Backup group File
file_owner_backup_etc_passwdVerify User Who Owns Backup passwd File
file_owner_backup_etc_shadowVerify Group Who Owns Backup shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_permissions_backup_etc_groupVerify Permissions on Backup group File
file_permissions_backup_etc_passwdVerify Permissions on Backup passwd File
file_permissions_backup_etc_shadowVerify Permissions on Backup shadow File
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File

pcidss4

1.4.1

set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
set_ipv6_loopback_trafficSet configuration for IPv6 loopback traffic
set_loopback_trafficSet configuration for loopback traffic

10.2.1

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

10.2.1.2

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

10.2.1.3

audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information

10.2.1.4

display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

10.2.1.5

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
sudo_add_use_ptyEnsure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
sudo_custom_logfileEnsure Sudo Logfile Exists - sudo logfile

10.2.1.7

audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)

10.2.2

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

10.3.1

file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

10.3.2

audit_rules_immutableMake the auditd Configuration Immutable
rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

10.3.3

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
package_audit-audispd-plugins_installedEnsure the default plugins for the audit dispatcher are Installed

10.3.4

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment

10.5.1

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
ensure_logrotate_activatedEnsure Logrotate Runs Periodically

10.6.1

ntpd_specify_remote_serverSpecify a Remote NTP Server
package_chrony_installedThe Chrony package is installed
service_ntp_enabledEnable the NTP Daemon
service_ntpd_enabledEnable the NTP Daemon

10.6.2

chronyd_specify_remote_serverA remote time server for Chrony is configured
ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
ntpd_specify_remote_serverSpecify a Remote NTP Server

10.6.3

audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
audit_rules_time_stimeRecord Attempts to Alter Time Through stime
audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File

11.5.1.1

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

11.5.2

rpm_verify_hashesVerify File Hashes with RPM
rpm_verify_permissionsVerify and Correct File Permissions with RPM

configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy

2.2.3

sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

2.2.4

package_bind_removedUninstall bind Package
sshd_disable_x11_forwardingDisable X11 Forwarding
sshd_enable_pamEnable PAM

2.2.6

file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
service_cron_enabledEnable cron Service
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_tcp_forwardingDisable SSH TCP Forwarding
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_limit_user_accessLimit Users' SSH Access
sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
sshd_set_max_auth_triesSet SSH authentication attempt limit
sshd_set_max_sessionsSet SSH MaxSessions limit
sshd_set_maxstartupsEnsure SSH MaxStartups is configured

3.3.1.1

coredump_disable_backtracesDisable core dump backtraces
coredump_disable_storageDisable storing core dump
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs

3.3.1.2

coredump_disable_backtracesDisable core dump backtraces
coredump_disable_storageDisable storing core dump
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs

3.3.1.3

coredump_disable_backtracesDisable core dump backtraces
coredump_disable_storageDisable storing core dump
sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs

4.2.1

package_libreswan_installedInstall libreswan Package

6.3.3

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
security_patches_up_to_dateEnsure Software Patches Installed

7.2.6

file_groupowner_backup_etc_groupVerify Group Who Owns Backup group File
file_groupowner_backup_etc_gshadowVerify Group Who Owns Backup gshadow File
file_groupowner_backup_etc_passwdVerify Group Who Owns Backup passwd File
file_groupowner_backup_etc_shadowVerify User Who Owns Backup shadow File
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_backup_etc_groupVerify User Who Owns Backup group File
file_owner_backup_etc_gshadowVerify User Who Owns Backup gshadow File
file_owner_backup_etc_passwdVerify User Who Owns Backup passwd File
file_owner_backup_etc_shadowVerify Group Who Owns Backup shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_permissions_backup_etc_groupVerify Permissions on Backup group File
file_permissions_backup_etc_passwdVerify Permissions on Backup passwd File
file_permissions_backup_etc_shadowVerify Permissions on Backup shadow File
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File

8.2.1

account_unique_nameEnsure All Accounts on the System Have Unique Names
accounts_root_gid_zeroVerify Root Has A Primary GID 0

8.2.2

accounts_no_uid_except_zeroVerify Only Root Has UID 0
gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group

8.2.3

accounts_no_uid_except_zeroVerify Only Root Has UID 0

8.2.8

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

8.3.1

disable_host_authDisable Host-Based Authentication

8.3.10.1

accounts_maximum_age_login_defsSet Password Maximum Age

8.3.2

accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

8.3.6

no_empty_passwordsPrevent Login to Accounts With Empty Password

8.3.9

accounts_minimum_age_login_defsSet Password Minimum Age
accounts_password_warn_age_login_defsSet Password Warning Age
no_empty_passwordsPrevent Login to Accounts With Empty Password

8.6.1

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
no_direct_root_loginsDirect root Logins Not Allowed
securetty_root_login_console_onlyRestrict Virtual Console Root Logins

srg

SRG-APP-000026-CTR-000070

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000027-CTR-000075

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000028-CTR-000080

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000091-CTR-000160

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

SRG-APP-000095-CTR-000170

service_auditd_enabledEnable auditd Service

SRG-APP-000096-CTR-000175

auditd_log_formatResolve information before writing to audit logs

SRG-APP-000097-CTR-000180

auditd_log_formatResolve information before writing to audit logs

SRG-APP-000098-CTR-000185

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_log_formatResolve information before writing to audit logs

SRG-APP-000099-CTR-000190

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_log_formatResolve information before writing to audit logs

SRG-APP-000100-CTR-000195

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_log_formatResolve information before writing to audit logs

SRG-APP-000100-CTR-000200

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_log_formatResolve information before writing to audit logs

SRG-APP-000109-CTR-000215

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_log_formatResolve information before writing to audit logs

SRG-APP-000118-CTR-000240

file_groupowner_var_logVerify Group Who Owns /var/log Directory
file_owner_var_logVerify User Who Owns /var/log Directory
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
file_permissions_var_logVerify Permissions on /var/log Directory

SRG-APP-000119-CTR-000245

audit_rules_immutableMake the auditd Configuration Immutable

SRG-APP-000120-CTR-000250

audit_rules_immutableMake the auditd Configuration Immutable

SRG-APP-000141-CTR-000315

service_sshd_disabledDisable SSH Server If Possible

SRG-APP-000148-CTR-000335

sshd_disable_root_loginDisable SSH Root Login

SRG-APP-000185-CTR-000490

service_sshd_disabledDisable SSH Server If Possible

SRG-APP-000190-CTR-000500

sshd_disable_root_loginDisable SSH Root Login

SRG-APP-000290-CTR-000670

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_log_formatResolve information before writing to audit logs

SRG-APP-000291-CTR-000675

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000292-CTR-000680

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000293-CTR-000685

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000294-CTR-000690

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000319-CTR-000745

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000320-CTR-000750

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000357-CTR-000800

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_log_formatResolve information before writing to audit logs
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

SRG-APP-000409-CTR-000990

service_auditd_enabledEnable auditd Service

SRG-APP-000450-CTR-001105

sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

SRG-APP-000492-CTR-001220

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

SRG-APP-000493-CTR-001225

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

SRG-APP-000494-CTR-001230

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

SRG-APP-000495-CTR-001235

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)

SRG-APP-000496-CTR-001240

audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr

SRG-APP-000497-CTR-001245

audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr

SRG-APP-000498-CTR-001250

audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr

SRG-APP-000499-CTR-001255

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

SRG-APP-000500-CTR-001260

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

SRG-APP-000501-CTR-001265

audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

SRG-APP-000502-CTR-001270

audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

SRG-APP-000505-CTR-001285

audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information

SRG-APP-000507-CTR-001295

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

SRG-APP-000508-CTR-001300

service_auditd_enabledEnable auditd Service

SRG-APP-000509-CTR-001305

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-APP-000510-CTR-001310

service_auditd_enabledEnable auditd Service

SRG-OS-000004-GPOS-00004

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000021-GPOS-00005

accounts_passwords_pam_faillock_auditAccount Lockouts Must Be Logged

SRG-OS-000023-GPOS-00006

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

SRG-OS-000027-GPOS-00008

accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

SRG-OS-000032-GPOS-00013

sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

SRG-OS-000033-GPOS-00014

configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
sshd_rekey_limitForce frequent session key renegotiation

SRG-OS-000037-GPOS-00015

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000038-GPOS-00016

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000039-GPOS-00017

auditd_name_formatSet type of computer node name logging in audit logs
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000040-GPOS-00018

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000041-GPOS-00019

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000042-GPOS-00020

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000042-GPOS-00021

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000046-GPOS-00022

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
package_postfix_installedThe Postfix package is installed
postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
postfix_client_configure_mail_alias_postmasterConfigure System to Forward All Mail From Postmaster to The Root Account

SRG-OS-000047-GPOS-00023

auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_error_action_stigConfigure auditd Disk Error Action on Disk Error
auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_disk_full_action_stigConfigure auditd Disk Full Action when Disk Space Is Full
auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
auditd_data_retention_max_log_file_action_stigConfigure auditd max_log_file_action Upon Reaching Maximum Log Size

SRG-OS-000051-GPOS-00024

auditd_freqSet number of records to cause an explicit flush to audit logs
package_audit_installedEnsure the audit Subsystem is Installed
package_rsyslog_installedEnsure rsyslog is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000054-GPOS-00025

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000057-GPOS-00027

audit_rules_immutableMake the auditd Configuration Immutable
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

SRG-OS-000058-GPOS-00028

audit_rules_immutableMake the auditd Configuration Immutable
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

SRG-OS-000059-GPOS-00029

audit_rules_immutableMake the auditd Configuration Immutable
directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

SRG-OS-000062-GPOS-00031

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
auditd_local_eventsInclude Local Events in Audit Logs
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000063-GPOS-00032

file_groupownership_audit_configurationAudit Configuration Files Must Be Owned By Group root
file_ownership_audit_configurationAudit Configuration Files Must Be Owned By Root

SRG-OS-000064-GPOS-00033

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

SRG-OS-000074-GPOS-00042

sshd_allow_only_protocol2Allow Only SSH Protocol 2

SRG-OS-000075-GPOS-00043

accounts_minimum_age_login_defsSet Password Minimum Age

SRG-OS-000076-GPOS-00044

accounts_maximum_age_login_defsSet Password Maximum Age

SRG-OS-000078-GPOS-00046

accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

SRG-OS-000095-GPOS-00049

kernel_module_tipc_disabledDisable TIPC Support
kernel_module_uvcvideo_disabledDisable the uvcvideo module

SRG-OS-000104-GPOS-00051

gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group

SRG-OS-000105-GPOS-00052

sshd_enable_pubkey_authEnable Public Key Authentication

SRG-OS-000106-GPOS-00053

sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_enable_pubkey_authEnable Public Key Authentication

SRG-OS-000107-GPOS-00054

sshd_enable_pubkey_authEnable Public Key Authentication

SRG-OS-000108-GPOS-00055

sshd_enable_pubkey_authEnable Public Key Authentication

SRG-OS-000109-GPOS-00056

sshd_disable_root_loginDisable SSH Root Login

SRG-OS-000114-GPOS-00059

service_autofs_disabledDisable the Automounter

SRG-OS-000120-GPOS-00061

configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
package_libreswan_installedInstall libreswan Package

SRG-OS-000122-GPOS-00063

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000125-GPOS-00065

sshd_enable_pamEnable PAM

SRG-OS-000126-GPOS-00066

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

SRG-OS-000132-GPOS-00067

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access

SRG-OS-000134-GPOS-00068

selinux_stateEnsure SELinux State is Enforcing

SRG-OS-000138-GPOS-00069

dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set

SRG-OS-000163-GPOS-00072

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

SRG-OS-000191-GPOS-00080

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

SRG-OS-000196

package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

SRG-OS-000206-GPOS-00084

file_groupowner_var_logVerify Group Who Owns /var/log Directory
file_groupowner_var_log_messagesVerify Group Who Owns /var/log/messages File
file_groupowner_var_log_syslogVerify Group Who Owns /var/log/syslog File
file_owner_var_logVerify User Who Owns /var/log Directory
file_owner_var_log_messagesVerify User Who Owns /var/log/messages File
file_owner_var_log_syslogVerify User Who Owns /var/log/syslog File
file_permissions_var_logVerify Permissions on /var/log Directory
file_permissions_var_log_messagesVerify Permissions on /var/log/messages File
file_permissions_var_log_syslogVerify Permissions on /var/log/syslog File

SRG-OS-000228-GPOS-00088

sshd_enable_warning_bannerEnable SSH Warning Banner
sshd_enable_warning_banner_netEnable SSH Warning Banner

SRG-OS-000239-GPOS-00089

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000240-GPOS-00090

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

SRG-OS-000241-GPOS-00090

audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000241-GPOS-00091

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000250-GPOS-00093

configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

SRG-OS-000254-GPOS-00095

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000255-GPOS-00096

auditd_log_formatResolve information before writing to audit logs
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000256-GPOS-00097

rpm_verify_permissionsVerify and Correct File Permissions with RPM

SRG-OS-000257-GPOS-00098

rpm_verify_permissionsVerify and Correct File Permissions with RPM

SRG-OS-000258-GPOS-00099

dir_ownership_binary_dirsVerify that System Executable Have Root Ownership
dir_permissions_binary_dirsVerify that System Executable Directories Have Restrictive Permissions
rpm_verify_permissionsVerify and Correct File Permissions with RPM

SRG-OS-000259-GPOS-00100

dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
file_ownership_binary_dirsVerify that System Executables Have Root Ownership
file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions

SRG-OS-000269-GPOS-00103

service_systemd-journald_enabledEnable systemd-journald Service

SRG-OS-000278-GPOS-00108

rpm_verify_permissionsVerify and Correct File Permissions with RPM

SRG-OS-000279-GPOS-00109

sshd_set_idle_timeoutSet SSH Client Alive Interval
sshd_set_keepaliveSet SSH Client Alive Count Max
sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

SRG-OS-000297-GPOS-00115

service_ufw_enabledVerify ufw Enabled

SRG-OS-000303-GPOS-00120

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000304-GPOS-00121

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

SRG-OS-000312-GPOS-00122

sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

SRG-OS-000312-GPOS-00123

sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

SRG-OS-000324-GPOS-00125

securetty_root_login_console_onlyRestrict Virtual Console Root Logins
sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

SRG-OS-000327-GPOS-00127

audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

SRG-OS-000337-GPOS-00129

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000341-GPOS-00132

partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

SRG-OS-000342-GPOS-00133

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_name_formatSet type of computer node name logging in audit logs
auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
package_audit-audispd-plugins_installedEnsure the default plugins for the audit dispatcher are Installed
rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

SRG-OS-000343-GPOS-00134

auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

SRG-OS-000348-GPOS-00136

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000349-GPOS-00137

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000350-GPOS-00138

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000351-GPOS-00139

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000352-GPOS-00140

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000353-GPOS-00141

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000354-GPOS-00142

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000355-GPOS-00143

chronyd_server_directiveEnsure Chrony is only configured with the server directive
package_chrony_installedThe Chrony package is installed
service_chronyd_enabledThe Chronyd service is enabled

SRG-OS-000356-GPOS-00144

chronyd_server_directiveEnsure Chrony is only configured with the server directive

SRG-OS-000358-GPOS-00145

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000359-GPOS-00146

chronyd_server_directiveEnsure Chrony is only configured with the server directive

SRG-OS-000364-GPOS-00151

sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication

SRG-OS-000365-GPOS-00152

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000366-GPOS-00153

ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed

SRG-OS-000368-GPOS-00154

mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

SRG-OS-000370-GPOS-00155

kernel_module_uvcvideo_disabledDisable the uvcvideo module

SRG-OS-000373-GPOS-00156

disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

SRG-OS-000373-GPOS-00157

disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

SRG-OS-000373-GPOS-00158

disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

SRG-OS-000378-GPOS-00163

service_autofs_disabledDisable the Automounter

SRG-OS-000392-GPOS-00172

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000393-GPOS-00173

configure_crypto_policyConfigure System Cryptography Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

SRG-OS-000394-GPOS-00174

configure_crypto_policyConfigure System Cryptography Policy
harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

SRG-OS-000395-GPOS-00175

sshd_set_idle_timeoutSet SSH Client Alive Interval

SRG-OS-000396-GPOS-00176

configure_crypto_policyConfigure System Cryptography Policy

SRG-OS-000423-GPOS-00187

configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
package_openssh-server_installedInstall the OpenSSH Server Package

SRG-OS-000424-GPOS-00188

package_openssh-server_installedInstall the OpenSSH Server Package

SRG-OS-000425-GPOS-00189

package_openssh-server_installedInstall the OpenSSH Server Package

SRG-OS-000426-GPOS-00190

configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
package_openssh-server_installedInstall the OpenSSH Server Package

SRG-OS-000433-GPOS-00192

sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access

SRG-OS-000433-GPOS-00193

sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

SRG-OS-000445-GPOS-00199

selinux_stateEnsure SELinux State is Enforcing

SRG-OS-000458-GPOS-00203

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

SRG-OS-000462-GPOS-00206

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000463-GPOS-00207

audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr

SRG-OS-000466-GPOS-00210

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

SRG-OS-000467-GPOS-00211

audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

SRG-OS-000468-GPOS-00212

audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

SRG-OS-000470-GPOS-00214

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

SRG-OS-000471-GPOS-00215

audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000474-GPOS-00219

audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr

SRG-OS-000475-GPOS-00220

package_audit_installedEnsure the audit Subsystem is Installed
service_auditd_enabledEnable auditd Service

SRG-OS-000476-GPOS-00221

audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

SRG-OS-000477-GPOS-00222

audit_privileged_commands_initEnsure auditd Collects Information on the Use of Privileged Commands - init
audit_privileged_commands_poweroffEnsure auditd Collects Information on the Use of Privileged Commands - poweroff
audit_privileged_commands_rebootEnsure auditd Collects Information on the Use of Privileged Commands - reboot
audit_privileged_commands_shutdownEnsure auditd Collects Information on the Use of Privileged Commands - shutdown

SRG-OS-000479-GPOS-00224

auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
auditd_name_formatSet type of computer node name logging in audit logs
auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
package_rsyslog_installedEnsure rsyslog is Installed
rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
rsyslog_remote_loghostEnsure Logs Sent To Remote Host

SRG-OS-000480-GPOS-00226

accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs

SRG-OS-000480-GPOS-00227

accounts_no_uid_except_zeroVerify Only Root Has UID 0
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
auditd_local_eventsInclude Local Events in Audit Logs
auditd_log_formatResolve information before writing to audit logs
auditd_write_logsWrite Audit Logs to the Disk
coredump_disable_backtracesDisable core dump backtraces
coredump_disable_storageDisable storing core dump
display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
file_groupowner_backup_etc_groupVerify Group Who Owns Backup group File
file_groupowner_backup_etc_gshadowVerify Group Who Owns Backup gshadow File
file_groupowner_backup_etc_passwdVerify Group Who Owns Backup passwd File
file_groupowner_backup_etc_shadowVerify User Who Owns Backup shadow File
file_groupowner_etc_groupVerify Group Who Owns group File
file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
file_groupowner_etc_passwdVerify Group Who Owns passwd File
file_groupowner_etc_shadowVerify Group Who Owns shadow File
file_owner_backup_etc_groupVerify User Who Owns Backup group File
file_owner_backup_etc_gshadowVerify User Who Owns Backup gshadow File
file_owner_backup_etc_passwdVerify User Who Owns Backup passwd File
file_owner_backup_etc_shadowVerify Group Who Owns Backup shadow File
file_owner_etc_groupVerify User Who Owns group File
file_owner_etc_gshadowVerify User Who Owns gshadow File
file_owner_etc_passwdVerify User Who Owns passwd File
file_owner_etc_shadowVerify User Who Owns shadow File
file_permissions_backup_etc_groupVerify Permissions on Backup group File
file_permissions_backup_etc_gshadowVerify Permissions on Backup gshadow File
file_permissions_backup_etc_passwdVerify Permissions on Backup passwd File
file_permissions_backup_etc_shadowVerify Permissions on Backup shadow File
file_permissions_etc_groupVerify Permissions on group File
file_permissions_etc_gshadowVerify Permissions on gshadow File
file_permissions_etc_passwdVerify Permissions on passwd File
file_permissions_etc_shadowVerify Permissions on shadow File
file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
no_empty_passwordsPrevent Login to Accounts With Empty Password
no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
package_gnutls-utils_installedEnsure gnutls-utils is installed
package_libreswan_installedInstall libreswan Package
package_nss-tools_installedEnsure nss-tools is installed
package_rsyslog_installedEnsure rsyslog is Installed
partition_for_homeEnsure /home Located On Separate Partition
partition_for_tmpEnsure /tmp Located On Separate Partition
partition_for_varEnsure /var Located On Separate Partition
partition_for_var_logEnsure /var/log Located On Separate Partition
partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
rpm_verify_hashesVerify File Hashes with RPM
rsyslog_remote_loghostEnsure Logs Sent To Remote Host
security_patches_up_to_dateEnsure Software Patches Installed
service_autofs_disabledDisable the Automounter
service_rsyslog_enabledEnable rsyslog Service
sshd_allow_only_protocol2Allow Only SSH Protocol 2
sshd_disable_compressionDisable Compression Or Set Compression to delayed
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_disable_gssapi_authDisable GSSAPI Authentication
sshd_disable_kerb_authDisable Kerberos Authentication
sshd_disable_rhostsDisable SSH Support for .rhosts Files
sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
sshd_disable_root_loginDisable SSH Root Login
sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
sshd_disable_x11_forwardingDisable X11 Forwarding
sshd_enable_strictmodesEnable Use of Strict Mode Checking
sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
sshd_print_last_logEnable SSH Print Last Log
sshd_rekey_limitForce frequent session key renegotiation
sshd_use_priv_separationEnable Use of Privilege Separation
sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

SRG-OS-000480-GPOS-00228

accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile

SRG-OS-000480-GPOS-00229

disable_host_authDisable Host-Based Authentication
sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
sshd_do_not_permit_user_envDo Not Allow SSH Environment Options

SRG-OS-000480-GPOS-00230

fapolicyd_prevent_home_folder_accessfapolicyd Must be Configured to Limit Access to Users Home Folders

References for product uos20