From 5011d395173adf85a36e1d959f20b0d16efc8411 Mon Sep 17 00:00:00 2001 From: Armando Acosta Date: Wed, 29 Jan 2025 10:35:05 -0600 Subject: [PATCH 1/2] Update OL8 V2R3 Signed-off-by: Armando Acosta --- products/ol8/profiles/stig.profile | 4 ++-- products/ol8/profiles/stig_gui.profile | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/products/ol8/profiles/stig.profile b/products/ol8/profiles/stig.profile index 4b46bd70c69..985ed095e89 100644 --- a/products/ol8/profiles/stig.profile +++ b/products/ol8/profiles/stig.profile @@ -1,7 +1,7 @@ documentation_complete: true metadata: - version: V2R2 + version: V2R3 reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux @@ -9,7 +9,7 @@ title: 'DISA STIG for Oracle Linux 8' description: |- This profile contains configuration checks that align to the - DISA STIG for Oracle Linux 8 V2R2. + DISA STIG for Oracle Linux 8 V2R3. selections: ### Variables diff --git a/products/ol8/profiles/stig_gui.profile b/products/ol8/profiles/stig_gui.profile index fbdcb184ae4..76355f4ec23 100644 --- a/products/ol8/profiles/stig_gui.profile +++ b/products/ol8/profiles/stig_gui.profile @@ -1,13 +1,13 @@ documentation_complete: true metadata: - version: V2R2 + version: V2R3 title: 'DISA STIG with GUI for Oracle Linux 8' description: |- This profile contains configuration checks that align to the - DISA STIG with GUI for Oracle Linux V2R2. + DISA STIG with GUI for Oracle Linux V2R3. Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If From e81f4608141d61040f5ea6273a30759e412a3270 Mon Sep 17 00:00:00 2001 From: Armando Acosta Date: Wed, 29 Jan 2025 10:36:01 -0600 Subject: [PATCH 2/2] Update OL8 STIG reference file to V2R3 Signed-off-by: Armando Acosta --- ...ml => disa-stig-ol8-v2r3-xccdf-manual.xml} | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) rename shared/references/{disa-stig-ol8-v2r2-xccdf-manual.xml => disa-stig-ol8-v2r3-xccdf-manual.xml} (99%) diff --git a/shared/references/disa-stig-ol8-v2r2-xccdf-manual.xml b/shared/references/disa-stig-ol8-v2r3-xccdf-manual.xml similarity index 99% rename from shared/references/disa-stig-ol8-v2r2-xccdf-manual.xml rename to shared/references/disa-stig-ol8-v2r3-xccdf-manual.xml index e159256efa4..7e5d2fce060 100644 --- a/shared/references/disa-stig-ol8-v2r2-xccdf-manual.xml +++ b/shared/references/disa-stig-ol8-v2r3-xccdf-manual.xml @@ -1,4 +1,4 @@ -acceptedOracle Linux 8 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 24 Oct 20243.51.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-OS-000037-GPOS-00015<GroupDescription></GroupDescription>OL08-00-030180The OL 8 audit package must be installed.<VulnDiscussion>Without establishing what type of events occurred and their source, location, and outcome, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. +acceptedOracle Linux 8 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 3 Benchmark Date: 30 Jan 20253.51.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-OS-000037-GPOS-00015<GroupDescription></GroupDescription>OL08-00-030180The OL 8 audit package must be installed.<VulnDiscussion>Without establishing what type of events occurred and their source, location, and outcome, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. @@ -413,19 +413,19 @@ $6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX Password hashes "!" or "*" indicate inactive accounts not available for logon and are not evaluated. -If any interactive user password hash does not begin with "$6$", this is a finding.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>OL08-00-010130The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.<VulnDiscussion>The system must use a strong hashing algorithm to store the password. The system must use a sufficient number of hashing rounds to ensure the required level of entropy. +If any interactive user password hash does not begin with "$6$", this is a finding.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>OL08-00-010130The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.<VulnDiscussion>The system must use a strong hashing algorithm to store the password. The system must use a sufficient number of hashing rounds to ensure the required level of entropy. -Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 8DISADPMS TargetOracle Linux 85416CCI-004062CCI-000196Configure OL 8 to encrypt all stored passwords with a strong cryptographic hash. +Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 8DISADPMS TargetOracle Linux 85416CCI-004062CCI-000196Configure OL 8 to encrypt all stored passwords with a strong cryptographic hash. -Edit/modify the following line in the "/etc/login.defs" file and set "SHA_CRYPT_MIN_ROUNDS" to a value no lower than "5000": +Edit/modify the following line in the "/etc/login.defs" file and set "SHA_CRYPT_MIN_ROUNDS" to a value no lower than "100000": -SHA_CRYPT_MIN_ROUNDS 5000Check that a minimum number of hash rounds is configured by running the following command: +SHA_CRYPT_MIN_ROUNDS 100000Check that a minimum number of hash rounds is configured by running the following command: $ sudo grep -E "^SHA_CRYPT_" /etc/login.defs -If only one of "SHA_CRYPT_MIN_ROUNDS" or "SHA_CRYPT_MAX_ROUNDS" is set, and this value is below "5000", this is a finding. +If only one of "SHA_CRYPT_MIN_ROUNDS" or "SHA_CRYPT_MAX_ROUNDS" is set, and this value is below "100000", this is a finding. -If both "SHA_CRYPT_MIN_ROUNDS" and "SHA_CRYPT_MAX_ROUNDS" are set, and the value for either is below "5000", this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>OL08-00-010140OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.<VulnDiscussion>If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for OL 8 and is designed to require a password to boot into single-user mode or modify the boot menu.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 8DISADPMS TargetOracle Linux 85416CCI-000213Configure the system to require an encrypted grub bootloader password for the grub superusers account with the grub2-setpassword command, which creates/overwrites the "/boot/efi/EFI/redhat/user.cfg" file. +If both "SHA_CRYPT_MIN_ROUNDS" and "SHA_CRYPT_MAX_ROUNDS" are set, and the value for either is below "100000", this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>OL08-00-010140OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.<VulnDiscussion>If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for OL 8 and is designed to require a password to boot into single-user mode or modify the boot menu.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 8DISADPMS TargetOracle Linux 85416CCI-000213Configure the system to require an encrypted grub bootloader password for the grub superusers account with the grub2-setpassword command, which creates/overwrites the "/boot/efi/EFI/redhat/user.cfg" file. Generate an encrypted grub2 password for the grub superusers account with the following command: @@ -1245,7 +1245,7 @@ $ sudo grep -r kernel.perf_event_paranoid /run/sysctl.d/*.conf /usr/local/lib/sy If "kernel.perf_event_paranoid" is not set to "2" or is missing or commented out, this is a finding. -If conflicting results are returned, this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL08-00-010380OL 8 must require users to provide a password for privilege escalation.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. +If conflicting results are returned, this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL08-00-010380OL 8 must require users to provide a password for privilege escalation.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate. @@ -1267,7 +1267,7 @@ $ sudo grep -ir nopasswd /etc/sudoers /etc/sudoers.d %admin ALL=(ALL) NOPASSWD: ALL -If any occurrences of "NOPASSWD" are returned from the command and have not been documented with the information system security officer (ISSO) as an organizationally defined administrative group using multifactor authentication (MFA), this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL08-00-010381OL 8 must require users to reauthenticate for privilege escalation and changing roles.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. +If any occurrences of "NOPASSWD" are returned from the command and have not been documented with the information system security officer (ISSO) as an organizationally defined administrative group using multifactor authentication (MFA), this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL08-00-010381OL 8 must require users to reauthenticate for privilege escalation and changing roles.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate. @@ -1301,7 +1301,7 @@ Remove any configurations that conflict with the above from the following locati If conflicting results are returned, this is a finding. If "Defaults !targetpw" is not defined, this is a finding. If "Defaults !rootpw" is not defined, this is a finding. -If "Defaults !runaspw" is not defined, this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL08-00-010384OL 8 must require reauthentication when using the "sudo" command.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. +If "Defaults !runaspw" is not defined, this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL08-00-010384OL 8 must require reauthentication when using the "sudo" command.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the organization requires the user to reauthenticate when using the "sudo" command. @@ -3299,7 +3299,7 @@ Check for the value of "PASS_MIN_DAYS" in "/etc/login.defs" with the following c $ sudo grep -i pass_min_days /etc/login.defs PASS_MIN_DAYS 1 -If the "PASS_MIN_DAYS" parameter value is not "1" or greater or is commented out, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>OL08-00-020200OL 8 user account passwords must have a 60-day maximum password lifetime restriction.<VulnDiscussion>Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If OL 8 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that OL 8 passwords could be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 8DISADPMS TargetOracle Linux 85416CCI-004066CCI-000199Configure OL 8 to enforce a 60-day maximum password lifetime. +If the "PASS_MIN_DAYS" parameter value is not "1" or greater or is commented out, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>OL08-00-020200OL 8 user account passwords must have a 60-day maximum password lifetime restriction.<VulnDiscussion>Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If OL 8 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that OL 8 passwords could be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 8DISADPMS TargetOracle Linux 85416CCI-004066CCI-000199Configure OL 8 to enforce a 60-day maximum password lifetime. Add or modify the following line in the "/etc/login.defs" file: @@ -3308,7 +3308,7 @@ PASS_MAX_DAYS 60SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>OL08-00-020210OL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime.<VulnDiscussion>Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If OL 8 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that OL 8 passwords could be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 8DISADPMS TargetOracle Linux 85416CCI-004066CCI-000199Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction. +If the "PASS_MAX_DAYS" parameter value is greater than "60", or commented out, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>OL08-00-020210OL 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime.<VulnDiscussion>Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If OL 8 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that OL 8 passwords could be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 8DISADPMS TargetOracle Linux 85416CCI-004066CCI-000199Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction. $ sudo chage -M 60 [user]Verify the maximum time period for existing passwords is restricted to 60 days with the following commands: @@ -3733,7 +3733,7 @@ $ sudo grep "postmaster:\s*root$" /etc/aliases postmaster: root -If the command does not return a line or the line is commented out, this is a finding.SRG-OS-000047-GPOS-00023<GroupDescription></GroupDescription>OL08-00-030040The OL 8 System must take appropriate action when an audit processing failure occurs.<VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. +If the command does not return a line or the line is commented out, this is a finding.SRG-OS-000047-GPOS-00023<GroupDescription></GroupDescription>OL08-00-030040The OL 8 System must take appropriate action when an audit processing failure occurs.<VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. @@ -3749,7 +3749,7 @@ $ sudo grep disk_error_action /etc/audit/auditd.conf disk_error_action = HALT -If the value of the "disk_error_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, this is a finding.SRG-OS-000047-GPOS-00023<GroupDescription></GroupDescription>OL08-00-030060The OL 8 audit system must take appropriate action when the audit storage volume is full.<VulnDiscussion>It is critical that when OL 8 is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. +If the value of the "disk_error_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, this is a finding.SRG-OS-000047-GPOS-00023<GroupDescription></GroupDescription>OL08-00-030060The OL 8 audit system must take appropriate action when the audit storage volume is full.<VulnDiscussion>It is critical that when OL 8 is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. When availability is an overriding concern, other approved actions in response to an audit failure are as follows: @@ -5324,7 +5324,7 @@ space_left_action = email If the value of the "space_left_action" is not set to "email", or if the line is commented out, ask the System Administrator to indicate how the system is providing real-time alerts to the SA and ISSO. -If there is no evidence that real-time alerts are configured on the system, this is a finding.SRG-OS-000355-GPOS-00143<GroupDescription></GroupDescription>OL08-00-030740OL 8 must compare internal information system clocks at least every 24 hours with a server synchronized to an authoritative time source, such as the United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).<VulnDiscussion>Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. +If there is no evidence that real-time alerts are configured on the system, this is a finding.SRG-OS-000355-GPOS-00143<GroupDescription></GroupDescription>OL08-00-030740OL 8 must compare internal information system clocks at least every 24 hours with a server synchronized to an authoritative time source, such as the United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).<VulnDiscussion>Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. @@ -7561,7 +7561,7 @@ Verify the operating system does not have nested "include" files or directories $ sudo grep -Er include /etc/sudoers.d -If results are returned, this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL08-00-010385The OL 8 operating system must not be configured to bypass password requirements for privilege escalation.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. +If results are returned, this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL08-00-010385The OL 8 operating system must not be configured to bypass password requirements for privilege escalation.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.