Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/auxiliary/stig_overlay.xml | 1338 ++++++++++++++++++++++++++++++++
1 files changed, 1338 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/auxiliary/stig_overlay.xml
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml
b/RHEL6/input/auxiliary/stig_overlay.xml
new file mode 100644
index 0000000..2c553bd
--- /dev/null
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -0,0 +1,1338 @@
+<?xml version="1.0"?>
+<overlays
xmlns="http://checklists.nist.gov/xccdf/1.1">
+ <overlay owner="disastig" ruleid="partition_for_tmp"
ownerid="RHEL-06-000001" disa="366" severity="low">
+ <title>The system must use a separate file system for /tmp.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="partition_for_var"
ownerid="RHEL-06-000002" disa="366" severity="low">
+ <title>The system must use a separate file system for /var.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="partition_for_var_log"
ownerid="RHEL-06-000003" disa="366" severity="low">
+ <title>The system must use a separate file system for /var/log.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="partition_for_var_log_audit"
ownerid="RHEL-06-000004" disa="137" severity="low">
+ <title>The system must use a separate file system for the system audit data
path.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000005" disa="138" severity="medium">
+ <title>The audit system must alert designated staff members when the audit
storage volume approaches capacity.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="partition_for_home"
ownerid="RHEL-06-000007" disa="366" severity="low">
+ <title>The system must use a separate file system for user home
directories.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000008" disa="352" severity="high">
+ <title>Vendor-provided cryptographic certificates must be installed to verify the
integrity of system software.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_rhnsd_disabled"
ownerid="RHEL-06-000009" disa="382" severity="low">
+ <title>The Red Hat Network Service (rhnsd) service must not be running, unless
using RHN or an RHN Satellite.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="security_patches_up_to_date"
ownerid="RHEL-06-000011" disa="1233" severity="medium">
+ <title>System security patches and updates must be installed and
up-to-date.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="ensure_gpgcheck_globally_activated" ownerid="RHEL-06-000013"
disa="663" severity="medium">
+ <title>The system package management tool must cryptographically verify the
authenticity of system software packages during installation.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="ensure_gpgcheck_never_disabled"
ownerid="RHEL-06-000015" disa="663" severity="low">
+ <title>The system package management tool must cryptographically verify the
authenticity of all software packages during installation.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="install_aide"
ownerid="RHEL-06-000016" disa="1069" severity="medium">
+ <title>A file integrity tool must be installed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_selinux_bootloader"
ownerid="RHEL-06-000017" disa="22" severity="medium">
+ <title>The system must use a Linux Security Module at boot time.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="no_rsh_trust_files"
ownerid="RHEL-06-000019" disa="1436" severity="high">
+ <title>There must be no .rhosts or hosts.equiv files on the
system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="set_selinux_state"
ownerid="RHEL-06-000020" disa="22" severity="medium">
+ <title>The system must use a Linux Security Module configured to enforce limits
on system services.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="set_selinux_policy"
ownerid="RHEL-06-000023" disa="22" severity="low">
+ <title>The system must use a Linux Security Module configured to limit the
privileges of system services.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="selinux_unlabeled_device_files"
ownerid="RHEL-06-000025" disa="22" severity="low">
+ <title>All device files must be monitored by the system Linux Security
Module.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000027" disa="770" severity="medium">
+ <title>The system must prevent the root account from logging in from virtual
consoles.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000028" disa="770" severity="low">
+ <title>The system must prevent the root account from logging in from serial
consoles.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000029" disa="366" severity="medium">
+ <title>Default system accounts, other than root, must be locked.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000030" disa="366" severity="high">
+ <title>The system must not have accounts configured with blank or null
passwords.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000031" disa="366" severity="medium">
+ <title>The /etc/passwd file must not contain password hashes.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000032" disa="366" severity="medium">
+ <title>The root account must be the only account having a UID of
0.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000033" disa="366" severity="medium">
+ <title>The /etc/shadow file must be owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000034" disa="366" severity="medium">
+ <title>The /etc/shadow file must be group-owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000035" disa="366" severity="medium">
+ <title>The /etc/shadow file must have mode 0000.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000036" disa="366" severity="medium">
+ <title>The /etc/gshadow file must be owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000037" disa="366" severity="medium">
+ <title>The /etc/gshadow file must be group-owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000038" disa="366" severity="medium">
+ <title>The /etc/gshadow file must have mode 0000.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000039" disa="366" severity="medium">
+ <title>The /etc/passwd file must be owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000040" disa="366" severity="medium">
+ <title>The /etc/passwd file must be group-owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000041" disa="366" severity="medium">
+ <title>The /etc/passwd file must have mode 0644 or less
permissive.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000042" disa="366" severity="medium">
+ <title>The /etc/group file must be owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000043" disa="366" severity="medium">
+ <title>The /etc/group file must be group-owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000044" disa="366" severity="medium">
+ <title>The /etc/group file must have mode 0644 or less permissive.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="file_permissions_library_dirs"
ownerid="RHEL-06-000045" disa="1499" severity="medium">
+ <title>Library files must have mode 0755 or less permissive.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="file_ownership_library_dirs"
ownerid="RHEL-06-000046" disa="1499" severity="medium">
+ <title>Library files must be owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="file_permissions_binary_dirs"
ownerid="RHEL-06-000047" disa="1499" severity="medium">
+ <title>All system command files must have mode 0755 or less
permissive.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="file_ownership_binary_dirs"
ownerid="RHEL-06-000048" disa="1499" severity="medium">
+ <title>All system command files must be owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="password_min_len"
ownerid="RHEL-06-000050" disa="205" severity="medium">
+ <title>The system must require passwords to contain a minimum of 14
characters.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="password_min_age"
ownerid="RHEL-06-000051" disa="198" severity="medium">
+ <title>Users must not be able to change passwords more than once every 24
hours.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="password_max_age"
ownerid="RHEL-06-000053" disa="199" severity="medium">
+ <title>User passwords must be changed at least every 60 days.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000054" disa="366" severity="low">
+ <title>Users must be warned 7 days in advance of password
expiration.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="password_require_digits"
ownerid="RHEL-06-000056" disa="194" severity="low">
+ <title>The system must require passwords to contain at least one numeric
character.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="password_require_uppercases"
ownerid="RHEL-06-000057" disa="192" severity="low">
+ <title>The system must require passwords to contain at least one uppercase
alphabetic character.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="password_require_specials"
ownerid="RHEL-06-000058" disa="1619" severity="low">
+ <title>The system must require passwords to contain at least one special
character.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="password_require_lowercases"
ownerid="RHEL-06-000059" disa="193" severity="low">
+ <title>The system must require passwords to contain at least one lowercase
alphabetic character.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="password_require_diffchars"
ownerid="RHEL-06-000060" disa="195" severity="low">
+ <title>The system must require at least four characters be changed between the
old and new passwords during a password change.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="deny_password_attempts"
ownerid="RHEL-06-000061" disa="44" severity="medium">
+ <title>The system must disable accounts after three consecutive unsuccessful
login attempts.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="set_password_hashing_algorithm_systemauth"
ownerid="RHEL-06-000062" disa="803" severity="medium">
+ <title>The system must use a FIPS 140-2 approved cryptographic hashing algorithm
for generating account password hashes (system-auth).</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="set_password_hashing_algorithm_logindefs"
ownerid="RHEL-06-000063" disa="803" severity="medium">
+ <title>The system must use a FIPS 140-2 approved cryptographic hashing algorithm
for generating account password hashes (login.defs).</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="set_password_hashing_algorithm_libuserconf"
ownerid="RHEL-06-000064" disa="803" severity="medium">
+ <title>The system must use a FIPS 140-2 approved cryptographic hashing algorithm
for generating account password hashes (libuser.conf).</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000065" disa="366" severity="medium">
+ <title>The system boot loader configuration file(s) must be owned by
root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000066" disa="366" severity="medium">
+ <title>The system boot loader configuration file(s) must be group-owned by
root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000067" disa="366" severity="medium">
+ <title>The system boot loader configuration file(s) must have mode 0600 or less
permissive.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="bootloader_password"
ownerid="RHEL-06-000068" disa="213" severity="medium">
+ <title>The system boot loader must require authentication.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="require_singleuser_auth"
ownerid="RHEL-06-000069" disa="213" severity="medium">
+ <title>The system must require authentication upon booting into single-user and
maintenance modes.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_interactive_boot"
ownerid="RHEL-06-000070" disa="213" severity="medium">
+ <title>The system must not permit interactive boot.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="install_screen_package"
ownerid="RHEL-06-000071" disa="58" severity="low">
+ <title>The system must allow locking of the console screen.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="set_system_login_banner"
ownerid="RHEL-06-000073" disa="1384, 1385, 1386, 1387, 1388"
severity="medium">
+ <title>The Department of Defense (DoD) login banner must be displayed immediately
prior to, or as part of, console login prompts.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000078" disa="366" severity="medium">
+ <title>The system must implement virtual address space
randomization.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000079" disa="366" severity="medium">
+ <title>The system must limit the ability of processes to have simultaneous write
and execute access to memory.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000080" disa="366" severity="medium">
+ <title>The system must not send ICMPv4 redirects by default.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000081" disa="366" severity="medium">
+ <title>The system must not send ICMPv4 redirects from any
interface.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000082" disa="366" severity="medium">
+ <title>IP forwarding for IPv4 must not be enabled, unless the system is a
router.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000083" disa="366" severity="medium">
+ <title>The system must not accept IPv4 source-routed packets on any
interface.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000084" disa="366" severity="medium">
+ <title>The system must not accept ICMPv4 redirect packets on any
interface.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000086" disa="366" severity="medium">
+ <title>The system must not accept ICMPv4 secure redirect packets on any
interface.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000088" disa="366" severity="low">
+ <title>The system must log Martian packets.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000089" disa="366" severity="medium">
+ <title>The system must not accept IPv4 source-routed packets by
default.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000090" disa="366" severity="medium">
+ <title>The system must not accept ICMPv4 secure redirect packets by
default.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000091" disa="366" severity="low">
+ <title>The system must ignore IPv4 ICMP redirect messages.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000092" disa="366" severity="low">
+ <title>The system must not respond to ICMPv4 sent to a broadcast
address.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000093" disa="366" severity="low">
+ <title>The system must ignore ICMPv4 bogus error responses.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="set_sysctl_net_ipv4_tcp_syncookies" ownerid="RHEL-06-000095"
disa="1095" severity="medium">
+ <title>The system must be configured to use TCP syncookies when experiencing a
TCP SYN flood.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000096" disa="366" severity="medium">
+ <title>The system must use a reverse-path filter for IPv4 network traffic when
possible on all interfaces.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000097" disa="366" severity="medium">
+ <title>The system must use a reverse-path filter for IPv4 network traffic when
possible by default.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000098" disa="366" severity="medium">
+ <title>The IPv6 protocol handler must not be bound to the network stack unless
needed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000099" disa="366" severity="medium">
+ <title>The system must ignore ICMPv6 redirects by default.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_ip6tables"
ownerid="RHEL-06-000103" disa="1118" severity="medium">
+ <title>The system must employ a local IPv6 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_ip6tables"
ownerid="RHEL-06-000105" disa="1117" severity="medium">
+ <title>The system must employ a local IPv6 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_ip6tables"
ownerid="RHEL-06-000106" disa="1098" severity="medium">
+ <title>The system must employ a local IPv6 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_ip6tables"
ownerid="RHEL-06-000107" disa="1100" severity="medium">
+ <title>The system must employ a local IPv6 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_ip6tables"
ownerid="RHEL-06-000108" disa="1097" severity="medium">
+ <title>The system must employ a local IPv6 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_ip6tables"
ownerid="RHEL-06-000109" disa="1414" severity="medium">
+ <title>The system must employ a local IPv6 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_iptables"
ownerid="RHEL-06-000113" disa="1118" severity="medium">
+ <title>The system must employ a local IPv4 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_iptables"
ownerid="RHEL-06-000115" disa="1117" severity="medium">
+ <title>The system must employ a local IPv4 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_iptables"
ownerid="RHEL-06-000116" disa="1098" severity="medium">
+ <title>The system must employ a local IPv4 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_iptables"
ownerid="RHEL-06-000117" disa="1100" severity="medium">
+ <title>The system must employ a local IPv4 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_iptables"
ownerid="RHEL-06-000118" disa="1097" severity="medium">
+ <title>The system must employ a local IPv4 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_iptables"
ownerid="RHEL-06-000119" disa="1414" severity="medium">
+ <title>The system must employ a local IPv4 firewall.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="set_iptables_default_rule"
ownerid="RHEL-06-000120" disa="66" severity="medium">
+ <title>The system's local IPv4 firewall must implement a deny-all,
allow-by-exception policy for inbound packets.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="set_iptables_default_rule"
ownerid="RHEL-06-000121" disa="1115" severity="medium">
+ <title>The system's local firewall must implement a deny-all,
allow-by-exception policy for inbound packets.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="set_iptables_default_rule"
ownerid="RHEL-06-000122" disa="1154" severity="medium">
+ <title>The system's local firewall must implement a deny-all,
allow-by-exception policy for inbound packets.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_protocol_dccp"
ownerid="RHEL-06-000124" disa="382" severity="medium">
+ <title>The Datagram Congestion Control Protocol (DCCP) must be disabled unless
required.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_protocol_sctp"
ownerid="RHEL-06-000125" disa="382" severity="medium">
+ <title>The Stream Control Transmission Protocol (SCTP) must be disabled unless
required.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_protocol_rds"
ownerid="RHEL-06-000126" disa="382" severity="low">
+ <title>The Reliable Datagram Sockets (RDS) protocol must be disabled unless
required.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_protocol_tipc"
ownerid="RHEL-06-000127" disa="382" severity="medium">
+ <title>The Transparent Inter-Process Communication (TIPC) protocol must be
disabled unless required.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="userowner_rsyslog_files"
ownerid="RHEL-06-000133" disa="1314" severity="medium">
+ <title>All rsyslog-generated log files must be owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="groupowner_rsyslog_files"
ownerid="RHEL-06-000134" disa="1314" severity="medium">
+ <title>All rsyslog-generated log files must be group-owned by
root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="rsyslog_file_permissions"
ownerid="RHEL-06-000135" disa="1314" severity="medium">
+ <title>All rsyslog-generated log files must have mode 0600 or less
permissive.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="rsyslog_send_messages_to_logserver" ownerid="RHEL-06-000136"
disa="1348" severity="medium">
+ <title>The operating system must back up audit records on an organization defined
frequency onto a different system or media than the system being audited. </title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000137" disa="136" severity="medium">
+ <title>The operating system must support the requirement to centrally manage the
content of audit records generated by organization defined information system
components.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000138" disa="366" severity="low">
+ <title>System logs must be rotated daily.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_service"
ownerid="RHEL-06-000139" disa="347" severity="medium">
+ <title>Auditing must be implemented.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_auditing"
ownerid="RHEL-06-000140" disa="157" severity="medium">
+ <title>The operating system audit records must be able to be used by a report
generation capability.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_service"
ownerid="RHEL-06-000142" disa="880" severity="medium">
+ <title>The operating system must audit nonlocal maintenance and diagnostic
sessions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_service"
ownerid="RHEL-06-000143" disa="1353" severity="medium">
+ <title>The operating system must produce a system-wide (logical or physical)
audit trail composed of audit records in a standardized format. </title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_service"
ownerid="RHEL-06-000145" disa="1487" severity="medium">
+ <title>The operating system must produce audit records containing sufficient
information to establish the identity of any user/subject associated with the
event.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_service"
ownerid="RHEL-06-000148" disa="67" severity="medium">
+ <title>The operating system must employ automated mechanisms to facilitate the
monitoring and control of remote access methods.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_service"
ownerid="RHEL-06-000149" disa="158" severity="medium">
+ <title>The operating system must provide the capability to automatically process
audit records for events of interest based upon selectable, event criteria.
</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_service"
ownerid="RHEL-06-000151" disa="1190" severity="medium">
+ <title>The operating system must fail to an organization defined known state for
organization defined types of failures. </title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_service"
ownerid="RHEL-06-000154" disa="130" severity="medium">
+ <title>The operating system must produce audit records containing sufficient
information to establish what type of events occurred.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_auditd_bootloader"
ownerid="RHEL-06-000157" disa="1464" severity="low">
+ <title>Auditing must be enabled at boot by setting a kernel
parameter.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000159" disa="366" severity="medium">
+ <title>The system must retain enough rotated audit logs to cover the required log
retention period.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000160" disa="366" severity="medium">
+ <title>The system must set a maximum audit log file size.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000161" disa="366" severity="medium">
+ <title>The system must rotate audit log files that reach the maximum file
size.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="configure_auditd_admin_space_left_action"
ownerid="RHEL-06-000163" disa="1343" severity="medium">
+ <title>The audit system must switch the system to single-user mode when available
audit storage volume becomes dangerously low.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_rules_time_adjtimex"
ownerid="RHEL-06-000165" disa="169" severity="low">
+ <title>The audit system must be configured to audit all attempts to alter system
time through adjtimex.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_rules_time_settimeofday"
ownerid="RHEL-06-000167" disa="169" severity="low">
+ <title>The audit system must be configured to audit all attempts to alter system
time through settimeofday.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_rules_time_stime"
ownerid="RHEL-06-000169" disa="169" severity="low">
+ <title>The audit system must be configured to audit all attempts to alter system
time through stime.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_rules_time_clock_settime"
ownerid="RHEL-06-000171" disa="169" severity="low">
+ <title>The audit system must be configured to audit all attempts to alter system
time through clock_settime.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_time_watch_localtime" ownerid="RHEL-06-000173"
disa="169" severity="low">
+ <title>The audit system must be configured to audit all attempts to alter system
time through /etc/localtime.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_account_changes"
ownerid="RHEL-06-000174" disa="18" severity="low">
+ <title>The operating system must automatically audit account
creation.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_account_changes"
ownerid="RHEL-06-000175" disa="1403" severity="low">
+ <title>The operating system must automatically audit account
modification.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_account_changes"
ownerid="RHEL-06-000176" disa="1404" severity="low">
+ <title>The operating system must automatically audit account disabling
actions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_account_changes"
ownerid="RHEL-06-000177" disa="1405" severity="low">
+ <title>The operating system must automatically audit account
termination.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000182" disa="366" severity="low">
+ <title>The audit system must be configured to audit modifications to the systems
network configuration.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000183" disa="366" severity="low">
+ <title>The audit system must be configured to audit modifications to the
system's Mandatory Access Control (MAC) configuration (SELinux).</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_chmod" ownerid="RHEL-06-000184"
disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using chmod.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_chown" ownerid="RHEL-06-000185"
disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using chown.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_fchmod" ownerid="RHEL-06-000186"
disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using fchmod.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_fchmodat"
ownerid="RHEL-06-000187" disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using fchmodat.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_fchown" ownerid="RHEL-06-000188"
disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using fchown.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_fchownat"
ownerid="RHEL-06-000189" disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using fchownat.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_fremovexattr"
ownerid="RHEL-06-000190" disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using fremovexattr.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_fsetxattr"
ownerid="RHEL-06-000191" disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using fsetxattr.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_lchown" ownerid="RHEL-06-000192"
disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using lchown.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_lremovexattr"
ownerid="RHEL-06-000193" disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using lremovexattr.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_lsetxattr"
ownerid="RHEL-06-000194" disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using lsetxattr.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_removexattr"
ownerid="RHEL-06-000195" disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using removexattr.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="audit_rules_dac_modification_setxattr"
ownerid="RHEL-06-000196" disa="172" severity="low">
+ <title>The audit system must be configured to audit all discretionary access
control permission modifications using setxattr.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_file_access"
ownerid="RHEL-06-000197" disa="172" severity="low">
+ <title>The audit system must be configured to audit failed attempts to access
files and programs.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_privileged_commands"
ownerid="RHEL-06-000198" disa="40" severity="low">
+ <title>The audit system must be configured to audit all use of setuid
programs.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_media_exports"
ownerid="RHEL-06-000199" disa="172" severity="low">
+ <title>The audit system must be configured to audit successful file system
mounts.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_file_deletions"
ownerid="RHEL-06-000200" disa="172" severity="low">
+ <title>The audit system must be configured to audit user deletions of files and
programs.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_sysadmin_actions"
ownerid="RHEL-06-000201" disa="172" severity="low">
+ <title>The audit system must be configured to audit changes to the
"/etc/sudoers" file.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="audit_kernel_module_loading"
ownerid="RHEL-06-000202" disa="172" severity="medium">
+ <title>The audit system must be configured to audit the loading and unloading of
dynamic kernel modules.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_xinetd"
ownerid="RHEL-06-000203" disa="382" severity="medium">
+ <title>The xinetd service must be disabled if no network services utilizing it
are enabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="uninstall_xinetd"
ownerid="RHEL-06-000204" disa="382" severity="low">
+ <title>The xinetd service must be uninstalled if no network services utilizing it
are enabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="uninstall_telnet_server"
ownerid="RHEL-06-000206" disa="381" severity="high">
+ <title>The telnet-server package must not be installed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_telnet_service"
ownerid="RHEL-06-000211" disa="888" severity="high">
+ <title>The telnet daemon must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="uninstall_rsh-server"
ownerid="RHEL-06-000213" disa="381" severity="high">
+ <title>The rsh-server package must not be installed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid=""
ownerid="RHEL-06-000214" disa="68" severity="high">
+ <title>The rshd service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_rexec"
ownerid="RHEL-06-000216" disa="68" severity="high">
+ <title>The rexecd service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_rlogin"
ownerid="RHEL-06-000218" disa="1436" severity="high">
+ <title>The rlogind service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="uninstall_ypserv"
ownerid="RHEL-06-000220" disa="381" severity="medium">
+ <title>The ypserv package must not be installed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_ypbind"
ownerid="RHEL-06-000221" disa="382" severity="medium">
+ <title>The ypbind service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="uninstall_tftp-server"
ownerid="RHEL-06-000222" disa="381" severity="medium">
+ <title>The tftp-server package must not be installed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_tftp"
ownerid="RHEL-06-000223" disa="1436" severity="medium">
+ <title>The TFTP service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_cron"
ownerid="RHEL-06-000224" disa="366" severity="medium">
+ <title>The cron service must be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_allow_only_protocol2"
ownerid="RHEL-06-000227" disa="774" severity="high">
+ <title>The SSH daemon must be configured to use only the SSHv2
protocol.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_set_idle_timeout"
ownerid="RHEL-06-000230" disa="1133" severity="low">
+ <title>The SSH daemon must set a timeout interval on idle
sessions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_set_keepalive"
ownerid="RHEL-06-000231" disa="879" severity="low">
+ <title>The SSH daemon must set a timeout count on idle sessions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_disable_rhosts"
ownerid="RHEL-06-000234" disa="766" severity="medium">
+ <title>The SSH daemon must ignore .rhosts files.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_host_auth"
ownerid="RHEL-06-000235" disa="765" severity="medium">
+ <title>The SSH daemon must not allow host-based authentication.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="disable_host_auth"
ownerid="RHEL-06-000236" disa="766" severity="medium">
+ <title>The SSH daemon must not allow host-based authentication.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_disable_root_login"
ownerid="RHEL-06-000237" disa="770" severity="medium">
+ <title>The system must not permit root logins using remote access programs such
as ssh.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_disable_empty_passwords"
ownerid="RHEL-06-000239" disa="766" severity="high">
+ <title>The SSH daemon must not allow authentication using an empty
password.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_enable_warning_banner"
ownerid="RHEL-06-000240" disa="48" severity="medium">
+ <title>The SSH daemon must be configured with the Department of Defense (DoD)
login banner.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_do_not_permit_user_env"
ownerid="RHEL-06-000241" disa="1414" severity="low">
+ <title>The SSH daemon must not permit user environment settings.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_use_approved_ciphers"
ownerid="RHEL-06-000243" disa="1144" severity="medium">
+ <title>The SSH daemon must be configured to use only FIPS 140-2 approved
ciphers.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_use_approved_ciphers"
ownerid="RHEL-06-000244" disa="1145" severity="medium">
+ <title>The operating system must employ FIPS-validated cryptography to protect
unclassified information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="sshd_use_approved_ciphers"
ownerid="RHEL-06-000245" disa="1146" severity="medium">
+ <title>The operating system must employ NSA-approved cryptography to protect
classified information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000246" disa="366" severity="low">
+ <title>The avahi service must be disabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_ntpd"
ownerid="RHEL-06-000247" disa="160" severity="medium">
+ <title>The system clock must be synchronized continuously, or at least
daily.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="ntpd_specify_remote_server"
ownerid="RHEL-06-000248" disa="160" severity="medium">
+ <title>The system clock must be synchronized to an authoritative DoD time
source.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="postfix_network_listening"
ownerid="RHEL-06-000249" disa="382" severity="medium">
+ <title>Mail relaying must be restricted.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000251" disa="778" severity="medium">
+ <title>The operating system must uniquely identify and authenticate an
organization defined list of specific devices and/or types of devices before establishing
a connection.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000252" disa="1453" severity="medium">
+ <title>If the system is using LDAP for authentication or account information, the
system must use a TLS connection using FIPS 140-2 approved cryptographic
algorithms.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000253" disa="776" severity="medium">
+ <title>The LDAP client must use a TLS connection using trust certificates signed
by the site CA.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000256" disa="366" severity="low">
+ <title>The openldap-servers package must not be installed unless
required.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="set_screensaver_inactivity_timeout" ownerid="RHEL-06-000257"
disa="57" severity="medium">
+ <title>The graphical desktop environment must set the idle timeout to no more
than 15 minutes.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_screensaver_after_idle"
ownerid="RHEL-06-000258" disa="57" severity="medium">
+ <title>The graphical desktop environment must automatically lock after 15 minutes
of inactivity and the system must require user to re-authenticate to unlock the
environment.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="enable_screensaver_password_lock" ownerid="RHEL-06-000259"
disa="57" severity="medium">
+ <title>The graphical desktop environment must have automatic lock
enabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="set_blank_screensaver"
ownerid="RHEL-06-000260" disa="60" severity="low">
+ <title>The system must display a publicly-viewable pattern during a graphical
desktop environment session lock.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_abrtd_disabled"
ownerid="RHEL-06-000261" disa="382" severity="low">
+ <title>The Automatic Bug Reporting Tool (abrtd) service must not be
running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_atd_disabled"
ownerid="RHEL-06-000262" disa="382" severity="low">
+ <title>The atd service must be disabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_autofs_disabled"
ownerid="RHEL-06-000263" disa="1250" severity="low">
+ <title>Automated file system mounting tools must not be enabled unless
needed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_ntpdate_disabled"
ownerid="RHEL-06-000265" disa="382" severity="low">
+ <title>The ntpdate service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_oddjobd_disabled"
ownerid="RHEL-06-000266" disa="382" severity="low">
+ <title>The oddjobd service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_qpidd_disabled"
ownerid="RHEL-06-000267" disa="382" severity="low">
+ <title>The qpidd service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_rdisc_disabled"
ownerid="RHEL-06-000268" disa="382" severity="low">
+ <title>The rdisc service must not be running.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="use_nodev_option_on_nfs_mounts"
ownerid="RHEL-06-000269" disa="366" severity="medium">
+ <title>Remote file systems must be mounted with the "nodev"
option.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="use_nosuid_option_on_nfs_mounts" ownerid="RHEL-06-000270"
disa="366" severity="medium">
+ <title>Remote file systems must be mounted with the "nosuid"
option.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="mountopt_noexec_on_removable_partitions"
ownerid="RHEL-06-000271" disa="87" severity="low">
+ <title>The noexec option must be added to removable media
partitions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000272" disa="366" severity="low">
+ <title>The system must use SMB client signing for connecting to samba servers
using smbclient.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000273" disa="366" severity="low">
+ <title>The system must use SMB client signing for connecting to samba servers
using mount.cifs.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="limiting_password_reuse"
ownerid="RHEL-06-000274" disa="200" severity="medium">
+ <title>The system must prohibit the reuse of passwords within twenty-four
iterations.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="encrypt_partitions"
ownerid="RHEL-06-000275" disa="1019" severity="low">
+ <title>The operating system must employ cryptographic mechanisms to protect
information in storage.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="encrypt_partitions"
ownerid="RHEL-06-000276" disa="1199" severity="low">
+ <title>The operating system must protect the confidentiality and integrity of
data at rest. </title>
+ </overlay>
+ <overlay owner="disastig" ruleid="encrypt_partitions"
ownerid="RHEL-06-000277" disa="1200" severity="low">
+ <title>The operating system must employ cryptographic mechanisms to prevent
unauthorized disclosure of data at rest unless otherwise protected by alternative physical
measures.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000278" disa="1493" severity="medium">
+ <title>The system package management tool must verify permissions on all files
and directories associated with the "audit" package.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000279" disa="1494" severity="medium">
+ <title>The system package management tool must verify ownership on all files and
directories associated with the "audit" package.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000280" disa="1495" severity="medium">
+ <title>The system package management tool must verify group-ownership on all
files and directories associated with the "audit" package.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000281" disa="1496" severity="medium">
+ <title>The system package management tool must verify contents of all files
associated with the audit package.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000282" disa="366" severity="medium">
+ <title>There must be no world-writable files on the system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="install_antivirus"
ownerid="RHEL-06-000284" disa="1668" severity="high">
+ <title>The system must use and update a DoD-approved virus scan
program.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="install_hids"
ownerid="RHEL-06-000285" disa="1263" severity="medium">
+ <title>The system must have a host-based intrusion detection tool
installed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000286" disa="366" severity="high">
+ <title>The x86 Ctrl-Alt-Delete key sequence must be disabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000287" disa="366" severity="low">
+ <title>The postfix service must be enabled for mail delivery.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000288" disa="366" severity="medium">
+ <title>The sendmail package must be removed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_netconsole_disabled"
ownerid="RHEL-06-000289" disa="382" severity="low">
+ <title>The netconsole service must be disabled unless required.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="packagegroup_xwindows_remove"
ownerid="RHEL-06-000290" disa="1436" severity="medium">
+ <title>X Windows must not be enabled unless required.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000291" disa="366" severity="low">
+ <title>The xorg-x11-server-common (X Windows) package must not be installed,
unless required.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000292" disa="366" severity="medium">
+ <title>The DHCP client must be disabled if not needed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000294" disa="366" severity="low">
+ <title>All GIDs referenced in /etc/passwd must be defined in
/etc/group</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="account_unique_name"
ownerid="RHEL-06-000296" disa="804" severity="low">
+ <title>All accounts on the system must have unique user or account
names</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000297" disa="16" severity="low">
+ <title>Temporary accounts must be provisioned with an expiration
date.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000298" disa="1682" severity="low">
+ <title>Emergency accounts must be provisioned with an expiration
date.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000299" disa="366" severity="low">
+ <title>The system must require passwords to contain no more than three
consecutive repeating characters.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="no_files_unowned_by_user"
ownerid="RHEL-06-000300" disa="224" severity="low">
+ <title>All files and directories must have a valid owner.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="no_files_unowned_by_group"
ownerid="RHEL-06-000301" disa="224" severity="low">
+ <title>All files must be owned by a group.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="aide_periodic_cron_checking"
ownerid="RHEL-06-000302" disa="374" severity="medium">
+ <title>A file integrity tool must be used at least weekly to check for
unauthorized file changes, particularly the addition of unauthorized system libraries or
binaries, or for unauthorized modification to authorized system libraries or
binaries.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="aide_periodic_cron_checking"
ownerid="RHEL-06-000303" disa="416" severity="medium">
+ <title>The operating system must employ automated mechanisms, per organization
defined frequency, to detect the addition of unauthorized components/devices into the
operating system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="aide_periodic_cron_checking"
ownerid="RHEL-06-000304" disa="1069" severity="medium">
+ <title>The operating system must employ automated mechanisms to detect the
presence of unauthorized software on organizational information systems and notify
designated organizational officials in accordance with the organization defined
frequency.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="aide_periodic_cron_checking"
ownerid="RHEL-06-000305" disa="1263" severity="medium">
+ <title>The operating system must provide a near real-time alert when any of the
organization defined list of compromise or potential compromise indicators occurs.
</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="aide_periodic_cron_checking"
ownerid="RHEL-06-000306" disa="1297" severity="medium">
+ <title>The operating system must detect unauthorized changes to software and
information. </title>
+ </overlay>
+ <overlay owner="disastig" ruleid="aide_periodic_cron_checking"
ownerid="RHEL-06-000307" disa="1589" severity="medium">
+ <title>The operating system must ensure unauthorized, security-relevant
configuration changes detected are tracked.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000308" disa="366" severity="low">
+ <title>Process core dumps must be disabled unless needed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="no_insecure_locks_exports"
ownerid="RHEL-06-000309" disa="764" severity="high">
+ <title>The NFS server must not have the insecure file locking option
enabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="143"
ownerid="RHEL-06-000311" disa="143" severity="medium">
+ <title>The audit system must provide a warning when allocated audit record
storage volume reaches a documented percentage of maximum audit record storage
capacity.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="configure_auditd_action_mail_acct" ownerid="RHEL-06-000313"
disa="139" severity="medium">
+ <title>The audit system must identify staff members to receive notifications of
audit log storage volume capacity issues.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="kernel_module_bluetooth_disabled" ownerid="RHEL-06-000315"
disa="85" severity="medium">
+ <title>The Bluetooth kernel module must be disabled.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="kernel_module_usb-storage_disabled" ownerid="RHEL-06-000317"
disa="1250" severity="medium">
+ <title>The system must have USB Mass Storage disabled unless
needed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="max_concurrent_login_sessions"
ownerid="RHEL-06-000319" disa="54" severity="low">
+ <title>The system must limit users to 10 simultaneous system logins, or a
site-defined number, in accordance with operational requirements.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="set_iptables_default_rule_forward" ownerid="RHEL-06-000320"
disa="1109" severity="medium">
+ <title>The system's local firewall must implement a deny-all,
allow-by-exception policy for forwarded packets.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="install_openswan"
ownerid="RHEL-06-000321" disa="1130" severity="low">
+ <title>The system must provide VPN connectivity for communications over untrusted
networks.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="enable_gdm_login_banner"
ownerid="RHEL-06-000324" disa="50" severity="medium">
+ <title>A login banner must be displayed immediately prior to, or as part of,
graphical desktop environment login prompts.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="set_gdm_login_banner_text"
ownerid="RHEL-06-000326" disa="1384, 1385, 1386, 1387, 1388"
severity="medium">
+ <title>The Department of Defense (DoD) login banner must be displayed immediately
prior to, or as part of, graphical desktop environment login prompts.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="service_bluetooth_disabled"
ownerid="RHEL-06-000331" disa="85" severity="medium">
+ <title>The Bluetooth service must be disabled.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="account_disable_post_pw_expiration" ownerid="RHEL-06-000334"
disa="17" severity="low">
+ <title>Accounts must be locked upon 35 days of inactivity.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="account_disable_post_pw_expiration" ownerid="RHEL-06-000335"
disa="795" severity="low">
+ <title>The operating system must manage information system identifiers for users
and devices by disabling the user identifier after an organization defined time period of
inactivity.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000336" disa="366" severity="low">
+ <title>The sticky bit must be set on all public directories.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000337" disa="366" severity="low">
+ <title>All public directories must be owned by a system account.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000338" disa="366" severity="high">
+ <title>The TFTP daemon must operate in "secure mode" which provides
access only to a single directory on the host file system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="ftp_log_transactions"
ownerid="RHEL-06-000339" disa="130" severity="low">
+ <title>The FTP daemon must be configured for logging or verbose
mode.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000340" disa="366" severity="medium">
+ <title>The snmpd service must use only SNMP protocol version 3 or
newer.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000341" disa="366" severity="high">
+ <title>The snmpd service must not use a default password.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000342" disa="366" severity="low">
+ <title>The system default umask for the bash shell must be 077.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000343" disa="366" severity="low">
+ <title>The system default umask for the csh shell must be 077.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000344" disa="366" severity="low">
+ <title>The system default umask in /etc/profile must be 077.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000345" disa="366" severity="low">
+ <title>The system default umask in /etc/login.defs must be 077.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000346" disa="366" severity="low">
+ <title>The system default umask for daemons must be 027 or 022.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="no_netrc_files"
ownerid="RHEL-06-000347" disa="196" severity="medium">
+ <title>There must be no .netrc files on the system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="ftp_present_banner"
ownerid="RHEL-06-000348" disa="48" severity="medium">
+ <title>The FTPS/FTP service on the system must be configured with the Department
of Defense (DoD) login banner.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="smartcard_auth"
ownerid="RHEL-06-000349" disa="765" severity="medium">
+ <title>The system must be configured to require the use of a CAC, PIV compliant
hardware token, or Alternate Logon Token (ALT) for authentication.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="deny_password_attempts_unlock_time" ownerid="RHEL-06-000356"
disa="47" severity="medium">
+ <title>The system must require administrator action to unlock an account locked
by excessive failed login attempts.</title>
+ </overlay>
+ <overlay owner="disastig"
ruleid="deny_password_attempts_fail_interval" ownerid="RHEL-06-000357"
disa="1452" severity="medium">
+ <title>The system must disable accounts after excessive login failures within a
15-minute interval.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000359" disa="20" severity="medium">
+ <title>The operating system must dynamically manage user privileges and
associated access authorizations.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000367" disa="31" severity="medium">
+ <title>The operating system must support organization defined one-way flows using
hardware mechanisms.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000368" disa="34" severity="medium">
+ <title>The operating system must provide the capability for a privileged
administrator to enable/disable organization defined security policy
filters.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000371" disa="52" severity="medium">
+ <title>The operating system, upon successful logon, must display to the user the
date and time of the last logon (access) via GUI.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="display_login_attempts"
ownerid="RHEL-06-000372" disa="53" severity="medium">
+ <title>The operating system, upon successful logon/access, must display to the
user the number of unsuccessful logon/access attempts since the last successful
logon/access.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000373" disa="56" severity="medium">
+ <title>The operating system must retain the session lock until the user
reestablishes access using established identification and authentication
procedures.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000374" disa="99" severity="medium">
+ <title>The operating system must employ automated mechanisms to enable authorized
users to make information sharing decisions based on access authorizations of sharing
partners and access restrictions on information to be shared.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_auditing"
ownerid="RHEL-06-000375" disa="131" severity="medium">
+ <title>The operating system must produce audit records containing sufficient
information to establish when (date and time) the events occurred.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_auditing"
ownerid="RHEL-06-000376" disa="132" severity="medium">
+ <title>The operating system must produce audit records containing sufficient
information to establish where the events occurred.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_auditing"
ownerid="RHEL-06-000377" disa="133" severity="medium">
+ <title>The operating system must produce audit records containing sufficient
information to establish the sources of the events.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_auditing"
ownerid="RHEL-06-000378" disa="134" severity="medium">
+ <title>The operating system must produce audit records containing sufficient
information to establish the outcome (success or failure) of the events.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_auditing"
ownerid="RHEL-06-000379" disa="135" severity="medium">
+ <title>The operating system must include organization defined additional, more
detailed information in the audit records for audit events identified by type, location,
or subject.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000380" disa="154" severity="medium">
+ <title>Operating system must support the capability to centralize the review and
analysis of audit records from multiple components within the system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000381" disa="156" severity="medium">
+ <title>The operating system must support an audit reduction
capability.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_auditing"
ownerid="RHEL-06-000382" disa="159" severity="medium">
+ <title>The operating system must use internal system clocks to generate time
stamps for audit records.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000383" disa="163" severity="medium">
+ <title>Audit log files must have mode 0640 or less permissive.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000384" disa="162" severity="medium">
+ <title>Audit log files must be owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000385" disa="164" severity="medium">
+ <title>Audit log directories must have mode 0755 or less
permissive.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000387" disa="171" severity="medium">
+ <title>The operating system must allow designated organizational personnel to
select which auditable events are to be audited by the operating system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_auditing"
ownerid="RHEL-06-000388" disa="174" severity="medium">
+ <title>The operating system must support the capability to compile audit records
from multiple components within the system into a system-wide (logical or physical) audit
trail that is time-correlated to within organization defined level of
tolerance.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000389" disa="185" severity="medium">
+ <title>The operating system, for PKI-based authentication must validate
certificates by constructing a certification path with status information to an accepted
trust anchor.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000390" disa="186" severity="medium">
+ <title>The operating system, for PKI-based authentication must enforce authorized
access to the corresponding private key.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000392" disa="206" severity="medium">
+ <title>The operating system must obscure feedback of authentication information
during the authentication process to protect the information from possible
exploitation/use by unauthorized individuals.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000396" disa="223" severity="medium">
+ <title>The operating system must bind security attributes to information to
facilitate information flow policy enforcement.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000397" disa="226" severity="medium">
+ <title>The operating system must provide the capability for a privileged
administrator to configure organization defined security policy filters to support
different security policies.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000398" disa="345" severity="medium">
+ <title>The operating system must enforce logical access restrictions associated
with changes to the information system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000399" disa="346" severity="medium">
+ <title>The operating system must employ automated mechanisms to enforce access
restrictions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000403" disa="386" severity="medium">
+ <title>The operating system must employ automated mechanisms to prevent program
execution in accordance with the organization defined specifications.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000411" disa="802" severity="medium">
+ <title>The operating system must dynamically manage identifiers, attributes, and
associated access authorizations.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000412" disa="872" severity="medium">
+ <title>The operating system must employ automated mechanisms to restrict the use
of maintenance tools to authorized personnel only.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000414" disa="1082" severity="medium">
+ <title>The operating system must separate user functionality (including user
interface services) from operating system management functionality.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000415" disa="1083" severity="medium">
+ <title>The operating system must prevent the presentation of information system
management-related functionality at an interface for general (i.e., non-privileged)
users.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000416" disa="1084" severity="medium">
+ <title>The operating system must isolate security functions from nonsecurity
functions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000417" disa="1086" severity="medium">
+ <title>The operating system must isolate security functions enforcing access and
information flow control from both non-security functions and from other security
functions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000418" disa="1087" severity="medium">
+ <title>The operating system must implement an information system isolation
boundary to minimize the number of non-security functions included within the boundary
containing security functions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000419" disa="1089" severity="medium">
+ <title>The operating system must implement security functions as a layered
structure minimizing interactions between layers of the design and avoiding any dependence
by lower layers on the functionality or correctness of higher layers.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000420" disa="1090" severity="medium">
+ <title>The operating system must prevent unauthorized and unintended information
transfer via shared system resources.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000421" disa="1091" severity="medium">
+ <title>The operating system must not share resources used to interface with
systems operating at different security levels.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000423" disa="1096" severity="medium">
+ <title>The operating system must limit the use of resources by
priority.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000424" disa="1111" severity="medium">
+ <title>The operating system must prevent remote devices that have established a
non-remote connection with the system from communicating outside of the communication path
with resources in external networks.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000430" disa="1127" severity="medium">
+ <title>The operating system must protect the integrity of transmitted
information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000431" disa="1128" severity="medium">
+ <title>The operating system must employ cryptographic mechanisms to recognize
changes to information during transmission unless otherwise protected by alternative
physical measures.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000432" disa="1129" severity="medium">
+ <title>The operating system must maintain the integrity of information during
aggregation, packaging, and transformation in preparation for transmission.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_finding_nonselected"
ownerid="RHEL-06-000445" disa="1158" severity="medium">
+ <title>The operating system must validate the integrity of security attributes
exchanged between systems.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000451" disa="1209" severity="medium">
+ <title>The operating system must protect the integrity of information during the
processes of data aggregation, packaging, and transformation in preparation for
transmission.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000454" disa="1214" severity="medium">
+ <title>The operating system must employ organization defined information system
components with no writeable storage that are persistent across component restart or power
on/off.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="update_process"
ownerid="RHEL-06-000455" disa="1232" severity="medium">
+ <title>The operating system must install software updates
automatically.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000456" disa="1237" severity="medium">
+ <title>The operating system must support automated patch management tools to
facilitate flaw remediation to organization defined information system
components.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000457" disa="1248" severity="medium">
+ <title>The operating system must prevent non-privileged users from circumventing
malicious code protection capabilities.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000458" disa="1265" severity="medium">
+ <title>The operating system must prevent non-privileged users from circumventing
intrusion detection and prevention capabilities.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000459" disa="1269" severity="medium">
+ <title>The operating system must protect information obtained from
intrusion-monitoring tools from unauthorized access, modification, and
deletion.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000460" disa="1291" severity="medium">
+ <title>The operating system must verify the correct operation of security
functions in accordance with organization defined conditions and in accordance with
organization defined frequency (if periodic verification).</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_finding_nonselected"
ownerid="RHEL-06-000461" disa="1294" severity="medium">
+ <title>The operating system must provide notification of failed automated
security tests.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_finding_nonselected"
ownerid="RHEL-06-000463" disa="1295" severity="medium">
+ <title>The operating system must provide automated support for the management of
distributed security testing.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000464" disa="1310" severity="medium">
+ <title>The operating system must check the validity of information
inputs.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000465" disa="1328" severity="medium">
+ <title>The operating system must support the requirement that organizations, if
an information system component failure is detected must activate an organization defined
alarm and/or automatically shuts down the operating system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000466" disa="1338" severity="medium">
+ <title>The operating system must associate the identity of the information
producer with the information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000473" disa="1362" severity="medium">
+ <title>The operating system must enforce an organization defined Discretionary
Access Control (DAC) policy that must allow users to specify and control sharing by named
individuals or groups of individuals, or by both.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000474" disa="1368" severity="medium">
+ <title>The operating system must enforce approved authorizations for controlling
the flow of information within the system in accordance with applicable
policy.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000485" disa="1399" severity="medium">
+ <title>The operating system must support and maintain the binding of organization
defined security attributes to information in storage.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000486" disa="1400" severity="medium">
+ <title>The operating system must support and maintain the binding of organization
defined security attributes to information in process.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000488" disa="1424" severity="medium">
+ <title>The operating system must dynamically reconfigure security attributes in
accordance with an identified security policy as information is created and
combined.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000489" disa="1425" severity="medium">
+ <title>The operating system must only allow authorized entities to change
security attributes.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000490" disa="1426" severity="medium">
+ <title>The operating system must maintain the binding of security attributes to
information with sufficient assurance that the information--attribute association can be
used as the basis for automated policy actions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000491" disa="1427" severity="medium">
+ <title>The operating system must only allow authorized users to associate
security attributes with information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000492" disa="1428" severity="medium">
+ <title>The operating system must display security attributes in human-readable
form on each object output from the system to system output devices to identify an
organization-identified set of special dissemination, handling, or distribution
instructions using organization-identified human readable, standard naming
conventions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000493" disa="1694" severity="medium">
+ <title>The operating system must enforce a Discretionary Access Control (DAC)
policy that includes or excludes access to the granularity of a single
user.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_finding_nonselected"
ownerid="RHEL-06-000494" disa="1500" severity="medium">
+ <title>The operating system must automatically implement organization defined
safeguards and countermeasures if security functions (or mechanisms) are changed
inappropriately.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000497" disa="1693" severity="medium">
+ <title>The operating system must enforce a Discretionary Access Control (DAC)
policy that limits propagation of access rights.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_generic"
ownerid="RHEL-06-000500" disa="1665" severity="medium">
+ <title>The operating system must preserve organization defined system state
information in the event of a system failure.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="met_inherently_nonselected"
ownerid="RHEL-06-000501" disa="1670" severity="medium">
+ <title>The operating system must take organization defined list of least
disruptive actions to terminate suspicious events.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000502" disa="1674" severity="medium">
+ <title>The operating system must respond to security function anomalies in
accordance with organization defined responses and alternative action(s).</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000503" disa="86" severity="medium">
+ <title>The system must have USB Mass Storage disabled unless
needed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000504" disa="535" severity="medium">
+ <title>The operating system must conduct backups of user-level information
contained in the operating system per organization defined frequency to conduct backups
consistent with recovery time and recovery point objectives.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000505" disa="537" severity="medium">
+ <title>The operating system must conduct backups of system-level information
contained in the information system per organization defined frequency to conduct backups
that are consistent with recovery time and recovery point objectives.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000506" disa="52" severity="medium">
+ <title>The operating system, upon successful logon, must display to the user the
date and time of the last logon or access via a local console or tty.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000507" disa="52" severity="medium">
+ <title>The operating system, upon successful logon, must display to the user the
date and time of the last logon or access via ssh.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000508" disa="58" severity="low">
+ <title>The system must allow locking of graphical desktop
sessions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000509" disa="136" severity="low">
+ <title>The system must forward audit records to the syslog
service.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000510" disa="140" severity="medium">
+ <title>The audit system must take appropriate action when the audit storage
volume is full.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000511" disa="140" severity="medium">
+ <title>The audit system must take appropriate action when there are disk errors
on the audit storage volume.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_finding_nonselected"
ownerid="RHEL-06-000512" disa="144" severity="medium">
+ <title>The audit system must alert designated staff members when audit storage
volume is full.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_finding_nonselected"
ownerid="RHEL-06-000513" disa="144" severity="medium">
+ <title>The audit system must alert designated staff members when audit storage
volume is generating disk errors.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000514" disa="352" severity="high">
+ <title>The RPM package management tool must cryptographically verify the
authenticity of all software packages during installation.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000515" disa="764" severity="low">
+ <title>The NFS server must not have the all_squash option enabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000516" disa="366" severity="low">
+ <title>The system package management tool must verify ownership on all files and
directories associated with packages.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000517" disa="366" severity="low">
+ <title>The system package management tool must verify group-ownership on all
files and directories associated with packages.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000518" disa="366" severity="low">
+ <title>The system package management tool must verify permissions on all files
and directories associated with packages.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000519" disa="366" severity="low">
+ <title>The system package management tool must verify contents of all files
associated with packages.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000521" disa="366" severity="medium">
+ <title>The mail system must forward all mail for root to one or more system
administrators.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000522" disa="162" severity="medium">
+ <title>Audit log files must be group-owned by root.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="XXXX"
ownerid="RHEL-06-000523" disa="66" severity="medium">
+ <title>The system's local IPv6 firewall must implement a deny-all,
allow-by-exception policy for inbound packets.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000001-NA" disa="15" severity="medium">
+ <title>The operating system must provide automated support for account management
functions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000006-NA" disa="21" severity="medium">
+ <title>The operating system must enforce dual authorization, based on
organizational policies and procedures for organization defined privileged
commands.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000008-NA" disa="24" severity="medium">
+ <title>The operating system must prevent access to organization defined
security-relevant information except during secure, non-operable system
states.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000009-NA" disa="25" severity="medium">
+ <title>The operating system must enforce information flow control using explicit
security attributes on information, source, and destination objects as a basis for flow
control decisions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000010-NA" disa="26" severity="medium">
+ <title>The operating system must enforce information flow control using protected
processing domains (e.g., domain type-enforcement) as a basis for flow control
decisions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000011-NA" disa="27" severity="medium">
+ <title>The operating system must enforce dynamic information flow control based
on policy that must allow or disallow information flows based upon changing conditions or
operational considerations.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000012-NA" disa="28" severity="medium">
+ <title>The operating system must prevent encrypted data from bypassing content
checking mechanisms.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000013-NA" disa="29" severity="medium">
+ <title>The operating system must enforce organization defined limitations on the
embedding of data types within other data types.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000014-NA" disa="30" severity="medium">
+ <title>The operating system must enforce information flow control on
metadata.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000016-NA" disa="32" severity="medium">
+ <title>The operating system must enforce information flow control using
organization defined security policy filters as a basis for flow control
decisions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000018-NA" disa="35" severity="medium">
+ <title>The operating system must provide the capability for a privileged
administrator to configure the organization defined security policy filters to support
different security policies.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000019-NA" disa="37" severity="medium">
+ <title>The operating system must implement separation of duties through assigned
information system access authorizations.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000060-NA" disa="165" severity="medium">
+ <title>The operating system must produce audit records on hardware-enforced,
write-once media.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000061-NA" disa="166" severity="medium">
+ <title>The operating system must protect against an individual falsely denying
having performed a particular action. </title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000068-NA" disa="187" severity="medium">
+ <title>The operating system, for PKI-based authentication must map the
authenticated identity to the user account.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000074-NA" disa="197" severity="medium">
+ <title>The operating system must enforce password encryption for
transmission.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000081-NA" disa="218" severity="medium">
+ <title>The operating system, when transferring information between different
security domains, must identify information flows by data type specification and
usage.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000082-NA" disa="219" severity="medium">
+ <title>The operating system, when transferring information between different
security domains, must decompose information into policy-relevant subcomponents for
submission to policy enforcement mechanisms.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000083-NA" disa="221" severity="medium">
+ <title>The operating system must enforce security policies regarding information
on interconnected systems.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000091-NA" disa="354" severity="medium">
+ <title>The operating system must enforce a two-person rule for changes to
organization defined information system components and system-level
information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000092-NA" disa="371" severity="medium">
+ <title>The operating system must employ automated mechanisms to centrally apply
configuration settings.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000093-NA" disa="372" severity="medium">
+ <title>The operating system must employ automated mechanisms to centrally verify
configuration settings.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000101-NA" disa="539" severity="medium">
+ <title>The operating system must conduct backups of operating system
documentation including security-related documentation per organization defined frequency
to conduct backups that is consistent with recovery time and recovery point
objectives.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000102-NA" disa="553" severity="medium">
+ <title>The operating system must implement transaction recovery for
transaction-based systems.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000107-NA" disa="767" severity="medium">
+ <title>The operating system must use multifactor authentication for local access
to privileged accounts.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000108-NA" disa="768" severity="medium">
+ <title>The operating system must use multifactor authentication for local access
to non-privileged accounts.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000110-NA" disa="771" severity="medium">
+ <title>The operating system must use multifactor authentication for network
access to privileged accounts where one of the factors is provided by a device separate
from the information system being accessed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000111-NA" disa="772" severity="medium">
+ <title>The operating system must use multifactor authentication for network
access to non-privileged accounts where one of the factors is provided by a device
separate from the operating system being accessed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000115-NA" disa="779" severity="medium">
+ <title>The operating system must authenticate devices before establishing remote
network connections using bidirectional cryptographically based authentication between
devices.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000116-NA" disa="780" severity="medium">
+ <title>The operating system must authenticate devices before establishing
wireless network connections using bidirectional cryptographically based authentication
between devices.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000117-NA" disa="781" severity="medium">
+ <title>The operating system must authenticate devices before establishing network
connections using bidirectional cryptographically based authentication between
devices.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000122-NA" disa="831" severity="medium">
+ <title>The operating system must implement a configurable capability to
automatically disable the operating system if any of the organization defined lists of
security violations are detected.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000125-NA" disa="877" severity="medium">
+ <title>The operating system must employ strong identification and authentication
techniques in the establishment of nonlocal maintenance and diagnostic
sessions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000128-NA" disa="884" severity="medium">
+ <title>The operating system must protect nonlocal maintenance sessions through
the use of a strong authenticator tightly bound to the user.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000130-NA" disa="1009"
severity="medium">
+ <title>The operating system must use cryptographic mechanisms to protect and
restrict access to information on portable digital media.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000140-NA" disa="1092"
severity="medium">
+ <title>The operating system must protect against or must limit the effects of the
organization defined or referenced types of Denial of Service attacks.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000141-NA" disa="1094"
severity="medium">
+ <title>The operating system must restrict the ability of users to launch Denial
of Service attacks against other information systems or networks.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000149-NA" disa="1112"
severity="medium">
+ <title>The operating system must route organization defined internal
communications traffic to organization defined external networks through authenticated
proxy servers within the managed interfaces of boundary protection devices.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000150" disa="1115" severity="medium">
+ <title>The operating system, at managed interfaces, must deny network traffic and
must audit internal users (or malicious code) posing a threat to external information
systems.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000153-NA" disa="1123"
severity="medium">
+ <title>The operating system must route all networked, privileged accesses through
a dedicated, managed interface for purposes of access control and auditing.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000154-NA" disa="1124"
severity="medium">
+ <title>The operating system must prevent discovery of specific system components
(or devices) composing a managed interface.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000155-NA" disa="1125"
severity="medium">
+ <title>The operating system must employ automated mechanisms to enforce strict
adherence to protocol format.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000156-NA" disa="1126"
severity="medium">
+ <title>The operating system must fail securely in the event of an operational
failure of a boundary protection device.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000161-NA" disa="1131"
severity="medium">
+ <title>The operating system must employ cryptographic mechanisms to prevent
unauthorized disclosure of information during transmission unless otherwise protected by
alternative physical measures.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000162-NA" disa="1132"
severity="medium">
+ <title>The operating system must maintain the confidentiality of information
during aggregation, packaging, and transformation in preparation for
transmission.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000164-NA" disa="1135"
severity="medium">
+ <title>The operating system must establish a trusted communications path between
the user and organization defined security functions within the operating
system.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000165-NA" disa="1140"
severity="medium">
+ <title>The operating system must produce, control, and distribute symmetric
cryptographic keys using NIST-approved or NSA-approved key management technology and
processes.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000166-NA" disa="1141"
severity="medium">
+ <title>The operating system must produce, control, and distribute symmetric and
asymmetric cryptographic keys using NSA-approved key management technology and
processes.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000167-NA" disa="1142"
severity="medium">
+ <title>The operating system must produce, control, and distribute asymmetric
cryptographic keys using approved PKI Class 3 certificates or prepositioned keying
material.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000168-NA" disa="1143"
severity="medium">
+ <title>The operating system must produce, control, and distribute asymmetric
cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware
security tokens that protect the user's private key.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000172-NA" disa="1147"
severity="medium">
+ <title>The operating system must employ FIPS-validated cryptography to protect
information when it must be separated from individuals who have the necessary clearances,
yet lack the necessary access approvals.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000173-NA" disa="1148"
severity="medium">
+ <title>The operating system must employ FIPS-validate or NSA-approved
cryptography to implement digital signatures.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000174-NA" disa="1149"
severity="medium">
+ <title>The operating system must protect the integrity and availability of
publicly available information and applications.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000175-NA" disa="1150"
severity="medium">
+ <title>The operating system must prohibit remote activation of collaborative
computing devices, excluding the organization defined exceptions where remote activation
is to be allowed.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000177-NA" disa="1157"
severity="medium">
+ <title>The operating system must associate security attributes with information
exchanged between information systems.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000179-NA" disa="1159"
severity="medium">
+ <title>The operating system must issue or obtain public key certificates under an
appropriate certificate policy from an approved service provider.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000180-NA" disa="1166"
severity="medium">
+ <title>The operating system must implement detection and inspection mechanisms to
identify unauthorized mobile code.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000181-NA" disa="1695"
severity="medium">
+ <title>The operating system must prevent the execution of prohibited mobile
code.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000182-NA" disa="1169"
severity="medium">
+ <title>The operating system must prevent the download of prohibited mobile
code.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000183-NA" disa="1170"
severity="medium">
+ <title>The operating system must prevent the automatic execution of mobile code
in organization defined software applications and must require organization defined
actions prior to executing the code.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000187-NA" disa="1210"
severity="medium">
+ <title>The operating system at organization defined information system components
must load and execute the operating environment from hardware-enforced, read-only
media.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000188-NA" disa="1211"
severity="medium">
+ <title>The operating system at organization defined information system components
must load and execute organization defined applications from hardware-enforced, read-only
media.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000193-NA" disa="1239 "
severity="medium">
+ <title>The operating system must have malicious code protection mechanisms at
system entry and exit points to detect and eradicate malicious code transported by
electronic mail, electronic mail attachments, web accesses, removable media, or other
common means.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000204-NA" disa="1311"
severity="medium">
+ <title>The operating system must identify potentially security-relevant error
conditions. </title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000205-NA" disa="1312"
severity="medium">
+ <title>The operating system must generate error messages providing information
necessary for corrective actions without revealing organization defined sensitive or
potentially harmful information in error logs and administrative messages that could be
exploited. </title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000209-NA" disa="1339"
severity="medium">
+ <title>The operating system must validate the binding of the information
producer's identity to the information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000210-NA" disa="1340"
severity="medium">
+ <title>The operating system must maintain reviewer/releaser identity and
credentials within the established chain of custody for all information reviewed or
released.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000211-NA" disa="1341"
severity="medium">
+ <title>The operating system must validate the binding of the reviewer's
identity to the information at the transfer/release point prior to release/transfer from
one security domain to another security domain.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000214-NA" disa="1274"
severity="medium">
+ <title>The operating system must employ automated mechanisms to alert security
personnel of any organization defined inappropriate or unusual activities with security
implications.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000216-NA" disa="1350"
severity="medium">
+ <title>The operating system must use cryptographic mechanisms to protect the
integrity of audit information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000217-NA" disa="1352"
severity="medium">
+ <title>The operating system must protect the audit records resulting from
nonlocal accesses to privileged accounts and the execution of privileged
functions.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000219-NA" disa="1356"
severity="medium">
+ <title>The operating system must monitor for atypical usage of operating system
accounts.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000222-NA" disa="1372"
severity="medium">
+ <title>The operating system, when transferring information between different
security domains, must implement policy filters constraining data structure and content to
organization defined information security policy requirements.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000223-NA" disa="1373"
severity="medium">
+ <title>The operating system, when transferring information between different
security domains, must detect unsanctioned information.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000224-NA" disa="1374"
severity="medium">
+ <title>The operating system, when transferring information between different
security domains, must prohibit the transfer of unsanctioned information in accordance
with the security policy.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000225-NA" disa="1376"
severity="medium">
+ <title>The operating system must uniquely identify source domains for information
transfer.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000226-NA" disa="1377"
severity="medium">
+ <title>The operating system must uniquely authenticate source domains for
information transfer.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000227-NA" disa="1383"
severity="medium">
+ <title>The operating system must provide additional protection for mobile devices
accessed via login by purging information from the device after organization defined
number of consecutive, unsuccessful login attempts to the mobile device.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000229-NA" disa="370" severity="medium">
+ <title>The operating system must employ automated mechanisms to centrally manage
configuration settings.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000233-NA" disa="1391"
severity="medium">
+ <title>The operating system must notify the user of the number of successful
logins/accesses that occur during the organization defined time period.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000234-NA" disa="1392"
severity="medium">
+ <title>The operating system must notify the user of the number of unsuccessful
login/access attempts that occur during organization defined time period.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000235-NA" disa="1395"
severity="medium">
+ <title>The operating system must notify the user of organization defined
security-related changes to the user's account that occur during the organization
defined time period.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000238-NA" disa="1401"
severity="medium">
+ <title>The operating system must support and maintain the binding of organization
defined security attributes to information in transmission.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000251-NA" disa="1454"
severity="medium">
+ <title>The operating system must ensure remote sessions for accessing an
organization defined list of security functions and security-relevant information are
audited.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000252-NA" disa="1462"
severity="medium">
+ <title>The operating system must provide the capability to capture/record and log
all content related to a user session.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000261-NA" disa="1555"
severity="medium">
+ <title>The operating system uniquely must identify destination domains for
information transfer.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000262-NA" disa="1556"
severity="medium">
+ <title>The operating system uniquely must authenticate destination domains for
information transfer.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000263-NA" disa="1557"
severity="medium">
+ <title>The operating system must track problems associated with the information
transfer.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000267-NA" disa="1632"
severity="medium">
+ <title>The operating system must protect nonlocal maintenance sessions by
separating the maintenance session from other network sessions with the information system
by either physically separated communications paths or logically separated communications
paths.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000268-NA" disa="1662"
severity="medium">
+ <title>The operating system must take corrective actions, when unauthorized
mobile code is identified.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000274-NA" disa="1683"
severity="medium">
+ <title>The operating system must notify, as required, appropriate individuals
when accounts are created.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000275-NA" disa="1684"
severity="medium">
+ <title>The operating system must notify, as required, appropriate individuals
when accounts are modified.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000276-NA" disa="1685"
severity="medium">
+ <title>The operating system must notify, as required, appropriate individuals
when account is disabled.</title>
+ </overlay>
+ <overlay owner="disastig" ruleid="unmet_nonfinding_scope"
ownerid="SRG-OS-000277-NA" disa="1686"
severity="medium">
+ <title>The operating system must notify, as required, appropriate individuals for
account termination. </title>
+ </overlay>
+</overlays>
--
1.7.1