What changed in Canonical Ubuntu 22.04 LTS SCAP Benchmark V2R8V2R8 changes

Check text

AND - /boot/grub/grub.cfg uses password_pbkdf2 for root textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/boot/grub/grub.cfg"; pattern pattern match "^\\s*(password\\S*)\\s+root\\s+"; instance greater than or equal "1" state textfilecontent54_state: subexpression equals "password_pbkdf2" Verify Ubuntu 22.04 LTS requires a password for authentication upon booting into single-user and maintenance modes by using the following command: $ sudo grep -i password /boot/grub/grub.cfg password_pbkdf2 root grub.pbkdf2.sha512.10000.03255F190F0E2F7B4F0D1C3216012309162F022A7A636771 If the root password entry does not begin with "password_pbkdf2", this is a finding.

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DODDoW-approved PKIs, all DODDoW systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.

V-260470 in V2R8

Check text

AND - None of the AllowUnauthenticated settings in /etc/apt/apt.conf.d/* are set to true textfilecontent54_test (check: all, existence: none_exist) object textfilecontent54_object: pattern pattern match "^\\S+::AllowUnauthenticated\\s+\"true\";$"; path equals "/etc/apt/apt.conf.d"; filename pattern match ".*"; instance greater than or equal "1" Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization by using the following command: $ grep -i allowunauthenticated /etc/apt/apt.conf.d/* /etc/apt/apt.conf.d/01-vendor-ubuntu:APT::Get::AllowUnauthenticated "false"; If "APT::Get::AllowUnauthenticated" is not set to "false", is commented out, or is missing, this is a finding.

Discussion

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA).

V-260476 in V2R8

Check text

AND - oval:mil.disa.stig.linux:tst:23835400 dpkginfo_test (check: all, existence: ) object dpkginfo_object: name equals "ufw" Verify that the Uncomplicated Firewall is installed by using the following command: $ dpkg -l | grep ufw ii ufw 0.36.1-4ubuntu0.1 all program for managing a Netfilter firewall If the "ufw" package is not installed, ask the system administrator if another application firewall is installed. If no application firewall is installed, this is a finding.

Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Ubuntu 22.04 LTS functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).

V-260514 in V2R8

Check text

AND - ufw.service is active systemdunitproperty_test (check: all, existence: at_least_one_exists) object systemdunitproperty_object: property equals "ActiveState"; unit equals "ufw.service" state systemdunitproperty_state: value equals "active" Verify the ufw is enabled on the system with the following command: $ sudo ufw status Status: active If the above command returns the status as "inactive" or any type of error, this is a finding.

Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Ubuntu 22.04 LTS functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).

V-260515 in V2R8

Title

Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS  140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

Check text

AND - /etc/ssh/sshd_config:Ciphers == DoDDoW-approved ciphers textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: filepath equals "/etc/ssh/sshd_config"; pattern pattern match "^\\s*(?i)Ciphers(?-i)[ \\t]+\\\"?([\\w,-@]+)\\\"?[\\s]*(?:|(?:#.*))?$"; instance greater than or equal "1" state textfilecontent54_state: subexpression pattern match "^(?:(aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr)|(aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes128-ctr,aes256-ctr)|(aes256-gcm@openssh.com,aes128-ctr,aes128-gcm@openssh.com,aes256-ctr)|(aes256-gcm@openssh.com,aes128-ctr,aes256-ctr,aes128-gcm@openssh.com)|(aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr)|(aes256-gcm@openssh.com,aes256-ctr,aes128-ctr,aes128-gcm@openssh.com)|(aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes128-ctr)|(aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes256-ctr)|(aes128-gcm@openssh.com,aes128-ctr,aes256-gcm@openssh.com,aes256-ctr)|(aes128-gcm@openssh.com,aes128-ctr,aes256-ctr,aes256-gcm@openssh.com)|(aes128-gcm@openssh.com,aes256-ctr,aes256-gcm@openssh.com,aes128-ctr)|(aes128-gcm@openssh.com,aes256-ctr,aes128-ctr,aes256-gcm@openssh.com)|(aes256-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes128-ctr)|(aes256-ctr,aes256-gcm@openssh.com,aes128-ctr,aes128-gcm@openssh.com)|(aes256-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com)|(aes256-ctr,aes128-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com)|(aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr)|(aes256-ctr,aes128-gcm@openssh.com,aes128-ctr,aes256-gcm@openssh.com)|(aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr)|(aes128-ctr,aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com)|(aes128-ctr,aes256-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com)|(aes128-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com)|(aes128-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes256-ctr)|(aes128-ctr,aes128-gcm@openssh.com,aes256-ctr,aes256-gcm@openssh.com))$" Verify the SSH server is configured to only implement FIPS-approved ciphers with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'ciphers' /etc/ssh/sshd_config:Ciphers aes256-ctr,aes256-gcm@openssh.com,aes128-ctr,aes128-gcm@openssh.com If "Ciphers" does not contain only the ciphers "aes256-ctr,aes256-gcm@openssh.com,aes128-ctr,aes128-gcm@openssh.com", is commented out, is missing, or conflicting results are returned, this is a finding.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network. Local maintenance and diagnostic activities are carried out by individuals physically present at the information system or information system component and not communicating across a network connection. Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions, which have common application in digital signatures, checksums, and message authentication codes. By specifying a cipher list with the order of ciphers being in a "strongest to weakest" orientation, the system will automatically attempt to use the strongest cipher for securing SSH connections. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000394-GPOS-00174, SRG-OS-000424-GPOS-00188

V-260531 in V2R8

Check text

AND - oval:mil.disa.stig.ind:tst:26053200 textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: filepath equals "/etc/ssh/sshd_config"; pattern pattern match "^\\s*MACs\\s+(\\S+)\\s*$"; instance greater than or equal "1" state textfilecontent54_state: subexpression equals "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256" state textfilecontent54_state: subexpression equals "\"hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256\"" Verify the SSH server is configured to only use MACs that employ FIPS 140-3 approved ciphers by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'macs' /etc/ssh/sshd_config:MACs hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com If "MACs" does not contain only the hashes "hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com" in exact order, is commented out, is missing, or conflicting results are returned, this is a finding.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection. Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions, which have common application in digital signatures, checksums, and message authentication codes. Satisfies: SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000424-GPOS-00188

V-260532 in V2R8

Title

Ubuntu 22.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DODDoW Notice and Consent Banner before granting local access to the system via a graphical user logon.

Check text

AND - /etc/gdm3/greeter.dconf-defaults has banner-message-enable set to true textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/etc/gdm3/greeter.dconf-defaults"; pattern pattern match "^\\s*banner-message-enable\\s*=\\s*(\\w+)$"; instance greater than or equal "1" state textfilecontent54_state: subexpression equals "true" Verify Ubuntu 22.04 LTS is configured to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the operating system via a graphical user logon by using the following command: Note: If no graphical user interface is installed, this requirement is not applicable. $ grep -i banner-message-enable /etc/gdm3/greeter.dconf-defaults banner-message-enable=true If the value for "banner-message-enable" is set to "false", the line is commented out, or no value is returned, this is a finding.

Fix text

Configure Ubuntu 22.04 LTS to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the operating system via a graphical user logon. Add or modify the following line in the "/etc/gdm3/greeter.dconf-defaults" file: [org/gnome/login-screen] banner-message-enable=true Update GDM with the new configuration by using the following commands: $ sudo dconf update $ sudo systemctl restart gdm3

Discussion

Display of a standardized and approved use notification before granting access to Ubuntu 22.04 LTS ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read (literal ampersand) consent to terms in IS user agreem't."

V-260535 in V2R8

Title

Ubuntu 22.04 LTS must benforce a 60-day maximum password blifetime restriction. Passwords enfor ncew users must have a 6180-day maximum password lifetime restriction.

Check text

AND - 0 -lt /etc/loginoval:mil.defsdisa.stig.ind:PASS_MAX_DAYS -le 60tst:25804100 textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: filepath equals "/etc/login.defs"; pattern pattern match "^[ \\st]*PASS_MAX_DAYS[ \\st]+(\\d*+)[ \\t]*$"; instance greater than or equal "1" state textfilecontent54_state: subexpression lessgreater than or equal "600" state textfilecontent54_state: subexpression greater than "0" Verify Ubuntu 22.04 LTS enforces a 60-day maximum password lifetime for new user accounts by using the following command: $ grep -i pass_max_days /etc/login.defs PASS_MAX_DAYS 60 If "PASS_MAX_DAYS" is less than "60", is commented out, or isequal missing, this is a finding."180"

Fix text

Configure Ubuntu 22.04 LTS to set noncompliant accounts to enforce a 60180-day maximum password lifetime restriction. Add$ orsudo modifychage the-M following180 line in the "/etc/login.defs" file: PASS_MAX_DAYS 60[user]

Discussion

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If theUbuntu operating22.04 systemLTS does not limit the lifetime of passwords and force users to change their passwords, there is the risk that theUbuntu operating22.04 systemLTS passwords could be compromised.

CCIs

CCI-004066,CCI-000199CCI-004066

V-260546 in V2R8

Check text

AND - /etc/default/useradd: INACTIVE is set to 35 or less, but not -1 textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: filepath equals "/etc/default/useradd"; pattern pattern match "(?i)^\\s*INACTIVE\\s*=\\s*(-?\\d+)\\s*$"; instance greater than or equal "1" state textfilecontent54_state: subexpression greater than or equal "0" state textfilecontent54_state: subexpression less than or equal "35" Verify the account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity by using the following command: Check the account inactivity value by performing the following command: $ grep INACTIVE /etc/default/useradd INACTIVE=35 If "INACTIVE" is set to "-1" or is not set to "35", is commented out, or is missing, this is a finding.

Fix text

Configure Ubuntu 22.04 LTS to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for adduser: $ sudo useradd -D -f 35 Note: DODDoW recommendation is 35 days, but a lower value is acceptable. The value "0" will disable the account immediately after the password expires.

V-260547 in V2R8

Check text

AND - oval:mil.disa.stig.linux:tst:23823000 dpkginfo_test (check: all, existence: all_exist) object dpkginfo_object: name equals "libpam-pkcs11" Verify Ubuntu 22.04 LTS has the packages required for multifactor authentication installed by using the following command: $ dpkg -l | grep libpam-pkcs11 ii libpam-pkcs11 0.6.11-4build2 amd64 Fully featured PAM module for using PKCS#11 smart cards If the "libpam-pkcs11" package is not installed, this is a finding.

Discussion

Using an authentication device, such as a CAC or token separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government personal identity verification card and the DODDoW common access card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055

V-260573 in V2R8

Check text

AND - package opensc-pkcs11 is installed dpkginfo_test (check: all, existence: all_exist) object dpkginfo_object: name equals "opensc-pkcs11" Verify the "opensc-pcks11" package is installed on the system by using the following command: $ dpkg -l | grep opensc-pkcs11 ii opensc-pkcs11:amd64 0.22.0-1Ubuntu2 amd64 Smart card utilities with support for PKCS#15 compatible cards If the "opensc-pcks11" package is not installed, this is a finding.

Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DODDoW has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems.

V-260574 in V2R8

Check text

AND OR AND - sshd_config includes sshd_config.d textfilecontent54_test (check: at least one, existence: at_least_one_exists) object textfilecontent54_object: pattern pattern match "^\\s*include\\s+(.*)\\s*$"; instance greater than or equal "1"; filepath equals "/etc/ssh/sshd_config"; behaviors equals "" state textfilecontent54_state: subexpression equals "/etc/ssh/sshd_config.d/*.conf" - /etc/ssh/sshd_config.d: PubkeyAuthentication is set to yes textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*(?i)PubkeyAuthentication(?-i)[ \\t]+([\\w\\\"]+)[\\s]*(?:|(?:#.*))?$"; path equals "/etc/ssh/sshd_config.d"; filename pattern match "^.+\\.conf$"; instance greater than or equal "1"; behaviors equals "" state textfilecontent54_state: subexpression pattern match "^(yes|\"yes\")$" - /etc/ssh/sshd_config: PubkeyAuthentication is set to yes textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*(?i)PubkeyAuthentication(?-i)[ \\t]+([\\w\\\"]+)[\\s]*(?:|(?:#.*))?$"; instance greater than or equal "1"; filepath equals "/etc/ssh/sshd_config"; behaviors equals "" state textfilecontent54_state: subexpression pattern match "^(yes|\"yes\")$" - /etc/pam.d/common-auth includes auth pam_pkcs11.so textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/etc/pam.d/common-auth"; pattern pattern match "^\\s*auth\\s+.*pam_pkcs11\\.so\\s*$"; instance greater than or equal "1" Verify that the "pam_pkcs11.so" module is configured by using the following command: $ grep -i pam_pkcs11.so /etc/pam.d/common-auth auth [success=3 default=ignore] pam_pkcs11.so If "pam_pkcs11.so" is commented out or is missing, this is a finding. Verify the sshd daemon allows public key authentication by using the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'pubkeyauthentication' /etc/ssh/sshd_config:PubkeyAuthentication yes If "PubkeyAuthentication" is not set to "yes" or is commented out or missing, or if conflicting results are returned, this is a finding.

Discussion

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: 1) Something a user knows (e.g., password/PIN); 2) Something a user has (e.g., cryptographic identification device, token); and 3) Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). The DODDoW common access card (CAC) with DODDoW-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055

V-260575 in V2R8

Check text

AND - Check pam_pkcs11.conf has all cert_policy set to include the ocsp_on option textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: filepath equals "/etc/pam_pkcs11/pam_pkcs11.conf"; pattern pattern match "^[\\s]*cert_policy[ \\t]+=[ \\t]+([\\w\\,\"' ]+);\\s*$"; instance greater than or equal "1" state textfilecontent54_state: subexpression pattern match "^[\"']*ocsp_on[\"']*$|^[\"']*ocsp_on[\"',\\s]|[\"',\\s]ocsp_on[\"',\\s]|[\"',\\s]ocsp_on[\"']*$" Verify Ubuntu 22.04 LTS electronically verifies PIV credentials via certificate status checking by using the following command: $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | sudo awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy | grep ocsp_on cert_policy = ca,signature,ocsp_on; If every returned "cert_policy" line is not set to "ocsp_on", the line is commented out, or is missing, this is a finding.

Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DODDoW has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems.

V-260576 in V2R8

Check text

AND - /etc/rsyslog.conf: auth.* is configured to be logged textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: - /etc/rsyslog.conf: authpriv.* is configured to be logged textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: - /etc/rsyslog.conf: daemon.* is configured to be logged textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: Verify that Ubuntu 22.04 LTS monitors all remote access methods by using the following command: $ grep -Er '^(auth\.\*,authpriv\.\*|daemon\.\*)' /etc/rsyslog.* /etc/rsyslog.d/50-default.conf:auth.*,authpriv.* /var/log/secure /etc/rsyslog.d/50-default.conf:daemon.* /var/log/messages If "auth.*", "authpriv.*", or "daemon.*" are not configured to be logged in at least one of the config files, this is a finding.

Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Automated monitoring of remote access sessions allows organizations to detect cyberattacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).

V-260589 in V2R8

Title

Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DODDoW-defined auditable events and actions in near real time.

Check text

AND - auditd is active systemdunitproperty_test (check: all, existence: at_least_one_exists) object systemdunitproperty_object: property equals "ActiveState"; unit equals "auditd.service" state systemdunitproperty_state: value equals "active" - auditd is enabled systemdunitproperty_test (check: all, existence: at_least_one_exists) object systemdunitproperty_object: property equals "UnitFileState"; unit equals "auditd.service" state systemdunitproperty_state: value equals "enabled" Verify the "auditd.service" is enabled and active by using the following commands: $ systemctl is-enabled auditd.service enabled $ systemctl is-active auditd.service active If the "auditd.service" is not enabled and active, this is a finding.

V-260591 in V2R8