What changed in Amazon Linux 2023 SCAP Benchmark V1R3V1R3 changes

Check text

AND - kernel.dmesg_restrict setting in kernel is 1 sysctl_test (check: all, existence: all_exist) object sysctl_object: name equals "kernel.dmesg_restrict" state sysctl_state: value equals "1" Verify Amazon Linux 2023 is configured to restrict access to the kernel message buffer with the following commands: Check the status of the kernel.dmesg_restrict kernel parameter. $ sudo sysctl kernel.dmesg_restrict kernel.dmesg_restrict = 1 If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.

Discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DODDoW or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Restricting access to the kernel message buffer limits access to only root. This prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069

V-274001 in V1R3

Check text

AND - kernel.perf_event_paranoid setting in kernel is 2 sysctl_test (check: all, existence: all_exist) object sysctl_object: name equals "kernel.perf_event_paranoid" state sysctl_state: value equals "2" Verify Amazon Linux 2023 is configured to prevent kernel profiling by nonprivileged users with the following commands: Check the status of the kernel.perf_event_paranoid kernel parameter. $ sudo sysctl kernel.perf_event_paranoid kernel.perf_event_paranoid = 2 If "kernel.perf_event_paranoid" is not set to "2" or is missing, this is a finding.

Discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DODDoW or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Setting the kernel.perf_event_paranoid kernel parameter to "2" prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069

V-274002 in V1R3

Check text

AND - Defaults timestamp_timeout is configured to a positive number in /etc/sudoers or /etc/sudoers.d. textfilecontent54_test (check: all, existence: only_one_exists) object textfilecontent54_object: state textfilecontent54_state: subexpression equals "0" Verify Amazon Linux 2023 requires reauthentication when using the "sudo" command to elevate privileges with the following command: $ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/ /etc/sudoers:Defaults timestamp_timeout=0 If results are returned from more than one file location, this is a finding. If "timestamp_timeout" is set to a negative number, is commented out, or no results are returned, this is a finding.

Fix text

Configure Amazon Linux 2023 to reauthenticate "sudo" commands after the specified timeout: Add the following line to "/etc/sudoers" or a file in "/etc/sudoers.d": Defaults timestamp_timeout=0 Remove any duplicate definitions.

V-274014 in V1R3

Check text

AND - libreswan package is installed rpminfo_test (check: all, existence: at_least_one_exists) object rpminfo_object: name equals "libreswan" Verify Amazon Linux 2023 has the libreswan package installed with the following command: $ dnf list --installed libreswan Installed Packages libreswan.x86_64 4.12-3.amzn2023.0.2 @amazonlinux If the "libreswan" package is not installed, this is a finding.

Discussion

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DODDoW data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DODDoW requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.

V-274032 in V1R3

Check text

AND - rsyslog-openssl package is installed rpminfo_test (check: all, existence: ) object rpminfo_object: name equals "rsyslog-openssl" Verify Amazon Linux 2023 has the rsyslog-openssl package installed with the following command: $ dnf list --installed rsyslog-openssl Installed Packages rsyslog-openssl.x86_64 8.2204.0-3.amzn2023.0.4 @amazonlinux If the "rsyslog-openssl" package is not installed, this is a finding.

Discussion

Unapproved mechanisms used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DODDoW data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DODDoW requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.

V-274035 in V1R3

Check text

AND - opensc package is installed rpminfo_test (check: all, existence: at_least_one_exists) object rpminfo_object: name equals "opensc" Verify Amazon Linux 2023 has the opensc package installed with the following command: $ sudo dnf list --installed opensc Installed Packages opensc.x86_64 0.24.0-1.amzn2023.0.4 @amazonlinux If the "opensc" package is not installed, this is a finding.

Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. The DODDoW has mandated the use of the Commoncommon Accessaccess Cardcard (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161

V-274036 in V1R3

Check text

AND - package openssl-pkcs11 is installed rpminfo_test (check: all, existence: all_exist) object rpminfo_object: name equals "openssl-pkcs11" Verify Amazon Linux 2023 has the openssl-pkcs11 package installed with the following command: $ dnf list --installed openssl-pkcs11 Installed Packages openssl-pkcs11.x86_64 0.4.12-3.amzn2023.0.1 @System If the "openssl-pkcs11" package is not installed, this is a finding.

Discussion

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DODDoW Commoncommon Accessaccess Cardcard (CAC) with DODDoW-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000377-GPOS-00162

V-274037 in V1R3

Title

Amazon Linux 2023 server must be configured to use only DODDoW-approved encryption ciphers employing FIPS 140-2/140-3 -validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Check text

AND - opensshserver.config ciphers correct textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: filepath equals "/etc/crypto-policies/back-ends/opensshserver.config"; pattern pattern match "^\\s*(?i)Ciphers(?-i)[ \\t]+(\\S+)[\\s]*(?:|(?:#.*))?$"; instance greater than or equal "1" state textfilecontent54_state: subexpression equals "aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr" state textfilecontent54_state: subexpression equals "\"aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr\"" Verify Amazon Linux 2023 SSH server is configured to use only ciphers employing FIPS 140-2/140-3 approved algorithms with the following command: $ sudo grep -i Ciphers /etc/crypto-policies/back-ends/opensshserver.config Ciphers aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr If the cipher entries in the "opensshserver.config" file have any ciphers other than "aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr", or they are missing or commented out, this is a finding.

Fix text

Configure Amazon Linux 2023 so that the SSH server uses only ciphers employing FIPS 140-2/140-3 -approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Amazon Server 2023 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.

V-274042 in V1R3

Title

Amazon Linux 2023 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2/140-3 -validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Check text

AND - oval:mil.disa.stig.ind:tst:25799100 textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: filepath equals "/etc/crypto-policies/back-ends/opensshserver.config"; pattern pattern match "^\\s*MACs\\s+(\\S+)\\s*$"; instance greater than or equal "1" state textfilecontent54_state: subexpression equals "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512" state textfilecontent54_state: subexpression equals "\"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512\"" Verify Amazon Linux 2023 SSH server is configured to use only MACs employing FIPS 140-2/140-3 approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ sudo grep -i MACs /etc/crypto-policies/back-ends/opensshserver.config MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 If the MACs entries in the "opensshserver.config" file have any hashes other than "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512", or they are missing or commented out, this is a finding.

Fix text

Configure Amazon Linux 2023 so that the SSH server uses only MACs employing FIPS 140-2/140-3 -approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Amazon Linux 2023 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.

V-274043 in V1R3

Check text

AND OR AND - sshd_config includes sshd_config.d textfilecontent54_test (check: at least one, existence: at_least_one_exists) object textfilecontent54_object: pattern pattern match "^\\s*include\\s+(.*)\\s*$"; instance greater than or equal "1"; filepath equals "/etc/ssh/sshd_config"; behaviors equals "" state textfilecontent54_state: subexpression equals "/etc/ssh/sshd_config.d/*.conf" - /etc/ssh/sshd_config.d: PubkeyAuthentication is set to yes textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*(?i)PubkeyAuthentication(?-i)[ \\t]+([\\w\\\"]+)[\\s]*(?:|(?:#.*))?$"; path equals "/etc/ssh/sshd_config.d"; filename pattern match "^.+\\.conf$"; instance greater than or equal "1"; behaviors equals "" state textfilecontent54_state: subexpression pattern match "^(yes|\"yes\")$" - /etc/ssh/sshd_config: PubkeyAuthentication is set to yes textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*(?i)PubkeyAuthentication(?-i)[ \\t]+([\\w\\\"]+)[\\s]*(?:|(?:#.*))?$"; instance greater than or equal "1"; filepath equals "/etc/ssh/sshd_config"; behaviors equals "" state textfilecontent54_state: subexpression pattern match "^(yes|\"yes\")$" Verify Amazon Linux 2023 is configured so that the SSH daemon accepts public key encryption with the following command: $ sudo grep -ir PubkeyAuthentication /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ /etc/ssh/sshd_config:#PubkeyAuthentication yes /etc/ssh/sshd_config.d/90-PubkeyAuth:PubkeyAuthentication yes If "PubkeyAuthentication" is set to no, the line is commented out, or the line is missing, this is a finding.

Discussion

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: 1. Something a user knows (e.g., password/PIN); 2. Something a user has (e.g., cryptographic identification device, token); and 3. Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). The DODDoW Commoncommon Accessaccess Cardcard (CAC) with DODDoW-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055

V-274047 in V1R3

Check text

AND - sssd.conf: pam_cert_auth = True textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: state textfilecontent54_state: subexpression case insensitive equals "true" Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify Amazon Linux 2023 has smart cards enabled in System Security Services Daemon (SSSD), run the following command: $ sudo grep -ir pam_cert_auth /etc/sssd/sssd.conf /etc/sssd/conf.d/ /etc/sssd/sssd.conf:pam_cert_auth = True If "pam_cert_auth" is not set to "True", the line is commented out, or the line is missing, this is a finding.

Discussion

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DODDoW Commoncommon Accessaccess Cardcard (CAC) with DODDoW-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000705-GPOS-00150

V-274059 in V1R3

Check text

AND - sssd config: certificate_verification: ocsp_dgst=sha512 textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: state textfilecontent54_state: subexpression pattern match "(?i)(^|,)ocsp_dgst=sha512(,|$)" Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify Amazon Linux 2023 implements Online Certificate Status Protocol (OCSP) and is using the proper digest value on the system with the following command: $ sudo grep -ir certificate_verification /etc/sssd/sssd.conf /etc/sssd/conf.d/ | grep -v "^#" certificate_verification = ocsp_dgst=sha512 If the certificate_verification line is missing from the [sssd] section, or is missing "ocsp_dgst=sha512", ask the administrator to indicate what type of multifactor authentication is being utilized and how the system implements certificate status checking. If there is no evidence of certificate status checking being used, this is a finding.

Discussion

Using an authentication device, such as a DODDoW Commoncommon Accessaccess Cardcard (CAC) or token that is separate from the information system, ensures that even if the information system is compromised, credentials stored on the authentication device will not be affected. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification (PIV) card and the DODDoW CAC. Amazon Linux 2023 includes multiple options for configuring certificate status checking, but for this requirement focuses on the System Security Services Daemon (SSSD). By default, SSSD performs Online Certificate Status Protocol (OCSP) checking and certificate verification using a sha256 digest function. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000377-GPOS-00162

V-274061 in V1R3

Title

Amazon Linux 2023 must display the Standard Mandatory DODoW Notice and Consent Banner before granting local or remote access to the system via a SSH logon.

Check text

AND - /etc/ssh/sshd_config:banner == /filepath textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: state textfilecontent54_state: subexpression pattern match "^\\/.+$" - /etc/ssh/sshd_config:banner != none textfilecontent54_test (check: all, existence: none_exist) object textfilecontent54_object: Verify Amazon Linux 2023 displays the Standard Mandatory DOD Notice and Consent Banner before granting access to the system from any SSH connection. Check for the location of the banner file being used with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*banner' /etc/ssh/sshd_config.d/80-bannerPointer.conf:Banner /etc/issue This command will return the banner keyword and the name of the file that contains the SSH banner (in this case "/etc/issue"). If the line is commented out, this is a finding.

Fix text

Configure Amazon Linux 2023 to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system via ssh. Edit the "etc/ssh/sshd_config" file or a file in "/etc/ssh/sshd_config.d" to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: Banner /etc/issue

Discussion

<VulnDiscussion>Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

V-274066 in V1R3

Check text

AND - /etc/audit/auditd.conf has mode 0600 or less permissive file_test (check: all, existence: ) object file_object: filepath equals "/etc/audit/auditd.conf" state file_state: gexec equals "false"; oread equals "false"; uexec equals "false"; sticky equals "false"; sgid equals "false"; suid equals "false"; oexec equals "false"; owrite equals "false"; gread equals "false"; gwrite equals "false" - .rules files in /etc/audit/rules.d have mode 0600 or less permissive file_test (check: all, existence: ) object file_object: path equals "/etc/audit/rules.d"; filename pattern match ".rules$" state file_state: gexec equals "false"; oread equals "false"; uexec equals "false"; sticky equals "false"; sgid equals "false"; suid equals "false"; oexec equals "false"; owrite equals "false"; gread equals "false"; gwrite equals "false" - /etc/audit/audit.rules has mode 0600 or less permissive file_test (check: all, existence: ) object file_object: filepath equals "/etc/audit/audit.rules" state file_state: gexec equals "false"; oread equals "false"; uexec equals "false"; sticky equals "false"; sgid equals "false"; suid equals "false"; oexec equals "false"; owrite equals "false"; gread equals "false"; gwrite equals "false" Verify Amazon Linux 2023 is configured so that files in "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file have a mode of "0640" or less permissive by using the following commands: $ sudo find /etc/audit/rules.d/ /etc/audit/audit.rules /etc/audit/auditd.conf -type f -exec stat -c "%a %n" {} \; 600 /etc/audit/rules.d/audit.rules 640 /etc/audit/audit.rules 640 /etc/audit/auditd.conf If the files in the "/etc/audit/rules.d/" directory or the "/etc/audit/auditd.conf" file have a mode more permissive than "0640", this is a finding.

Fix text

Configure Amazon Linux 2023 so that the rules files in "the directory /etc/audit/rules.d/", the /etc/audit/audit.rules file, and the "/etc/audit/auditd.conf" file to have a mode of "0600" or less permissive with the following commands: $ sudo chmodfind 0600 /etc/audit/rules.d/audit -type f -name "*.rules" -exec chmod 0600 {} + $ sudo chmod 0600 /etc/audit/rulesaudit.d/[customrulesfile].rules $ sudo chmod 0600 /etc/audit/auditd.conf

V-274111 in V1R3

Title

Amazon Linux 2023 must be able to enforce a 6180-day maximum password lifetime restriction.

Check text

AND - No password in /etc/shadow has a maximum password age of 0 or greater than 60180 shadow_test (check: all, existence: any_exist) object shadow_object: filter equals "oval:mil.disa.stig.unix:ste:23036702"; username pattern match ".+" state shadow_state: chg_req greater than "0" state shadow_state: chg_req less than or equal "60180" - Root password in /etc/shadow does not have a maximum password age of 0 or greater than 60180 shadow_test (check: all, existence: all_exist) object shadow_object: username equals "root" state shadow_state: chg_req greater than "0" state shadow_state: chg_req less than or equal "60180" Verify Amazon Linux 2023 enforces the maximum time period for existing passwords is restricted to 60 days with the following commands: $ sudo awk -F: '$5 > 60 {print $1 " " $5}' /etc/shadow $ sudo awk -F: '$5 <= 0 {print $1 " " $5}' /etc/shadow If any results are returned that are not associated with a system account, this is a finding.

Fix text

Configure Amazon Linux 2023 to set noncompliant accounts to enforce a 6180-day maximum password lifetime restriction. $ sudo chage -M 6180 [user]

V-274148 in V1R3

Check text

AND - The pam_unix module is included in password-auth and configured for 100000 or more rounds. textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: filepath equals "/etc/pam.d/password-auth"; pattern pattern match "^\\s*password\\s+sufficient\\s+pam_unix\\.so\\s+[^#\\n]*\\brounds=(\\d+)\\b"; instance greater than or equal "1" state textfilecontent54_state: subexpression greater than or equal "100000" Verify Amazon Linux 2023 has the required number of rounds for the password hashing algorithm is configured in password-auth with the following command: $ sudo grep rounds /etc/pam.d/password-auth password sufficient pam_unix.so sha512 rounds=100000 If a matching line is not returned or "rounds" is less than "100000", this a finding.

Discussion

Unapproved mechanisms, used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DODDoW data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DODDoW requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

V-274162 in V1R3

Check text

AND - The pam_unix module is included in system-auth and configured for 100000 or more rounds. textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: filepath equals "/etc/pam.d/system-auth"; pattern pattern match "^\\s*password\\s+sufficient\\s+pam_unix\\.so\\s+[^#\\n]*\\brounds=(\\d+)\\b"; instance greater than or equal "1" state textfilecontent54_state: subexpression greater than or equal "100000" Verify Amazon Linux 2023 has the required number of rounds for the password hashing algorithm is configured in system-auth with the following command: $ sudo grep rounds /etc/pam.d/system-auth password sufficient pam_unix.so sha512 rounds=100000 If a matching line is not returned or "rounds" is less than "100000", this a finding.

Discussion

Unapproved mechanisms used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DODDoW data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DODDoW requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

V-274163 in V1R3

Check text

AND - The system terminates idle user sessions. textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: filepath equals "/etc/systemd/logind.conf"; pattern pattern match "^\\s*StopIdleSessionSec\\s*=\\s*(-?\\d*)\\s*(?:#.*)?$"; instance greater than or equal "1" state textfilecontent54_state: subexpression equals "600" Verify Amazon Linux 2023 logs out sessions that are idle for 10 minutes with the following command: $ sudo grep -i ^StopIdleSessionSec /etc/systemd/logind.conf StopIdleSessionSec=600 If "StopIdleSessionSec" is not configured to "600" seconds, this is a finding.

V-274166 in V1R3

Title

Amazon Linux 2023 file system automount function must be disabled unless required.

Check text

AND OR AND - autofs.service LoadState is masked if it exists. systemdunitproperty_test (check: all, existence: any_exist) object systemdunitproperty_object: property equals "LoadState"; unit equals "autofs.service" state systemdunitproperty_state: value equals "masked" - autofs.service UnitFileState is masked if it exists. systemdunitproperty_test (check: all, existence: any_exist) object systemdunitproperty_object: property equals "UnitFileState"; unit equals "autofs.service" state systemdunitproperty_state: value equals "masked" - autofs.service UnitFileState is disabled if it exists. systemdunitproperty_test (check: all, existence: any_exist) object systemdunitproperty_object: property equals "UnitFileState"; unit equals "autofs.service" state systemdunitproperty_state: value equals "disabled" Verify Amazon Linux 2023 disables the file system automount function with the following command: $ sudo systemctl is-enabled autofs masked If the returned value is not "masked", "disabled", "Failed to get unit file state for autofs.service for autofs", or "enabled", and is not documented as operational requirement with the information system security officer (ISSO), this is a finding.

V-274182 in V1R3

Title

Amazon Linux 2023 must implement DODoW-approved encryption in the bind package.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Amazon Linux 2023 incorporates system-widesystemwide crypto policies by default. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/ directory. Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000426-GPOS-00190

V-283440 in V1R3

Title

The Amazon Linux 2023 SSH client must be configured to use only DODDoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography, enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Amazon Linux 2023 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/openssh.config file.

V-283442 in V1R3

Title

The Amazon Linux 2023 SSH client must be configured to use only DODDoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography, enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Amazon Linux 2023 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/openssh.config file.

V-283443 in V1R3