V1R6 changes
Canonical Ubuntu 24.04 LTS SCAP Benchmark V1R6 (2026-08-20) replaced V1R5 (2026-05-14): 3 rules added, 28 updated. It has 168 rules, against 165 in V1R5.
V1R6 benchmarkV1R5 benchmark Compare V1R5 and V1R6 in SCAP Compare
- 3 added
- 0 removed
- 28 updated
Updated fields: Check text 28Discussion 19Fix text 10Title 4CCIs 1
Added in V1R6 (3)
Updated in V1R6 (28)
V-270647CAT IUbuntu 24.04 LTS must not have the telnet package installed.Check text, Discussion
Check text
AND
- Telnetd package is not installed
dpkginfo_test (check: all, existence: none_exist)
object dpkginfo_object: name equals "telnetd"
Verify the telnet package is not installed on Ubuntu 24.04 LTS with the following command:
$ dpkg -l | grep telnetd
If the telnetd package is installed, this is a finding.
Discussion
Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best.
Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Ubuntu 24.04 LTS functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).
V-270654CAT IIUbuntu 24.04 LTS must have an application firewall installed in order to control remote access methods.Check text, Discussion
Check text
AND
- oval:mil.disa.stig.linux:tst:23835400
dpkginfo_test (check: all, existence: )
object dpkginfo_object: name equals "ufw"
Verify that the Uncomplicated Firewall (ufw) is installed with the following command:
$ dpkg -l | grep ufw
ii ufw 0.36.2-6 all program for managing a Netfilter firewall
If the "ufw" package is not installed, ask the system administrator if another application firewall is installed.
If no application firewall is installed, this is a finding.
Discussion
Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk, and make remote user access management difficult at best.
Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Ubuntu 24.04 LTS functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).
V-270655CAT IIUbuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw).Check text, Discussion
Check text
AND
- ufw.service is active
systemdunitproperty_test (check: all, existence: at_least_one_exists)
object systemdunitproperty_object: property equals "ActiveState"; unit equals "ufw.service"
state systemdunitproperty_state: value equals "active"
Verify the ufw is enabled on the system with the following command:
$ sudo ufw status
Status: active
If the above command returns the status as "inactive" or any type of error, this is a finding.
If the ufw is not installed, ask the system administrator if another application firewall is installed. If a different firewall is active on the system, this is not a finding.
Discussion
Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk, and make remote user access management difficult at best.
Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Ubuntu 24.04 LTS functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).
Satisfies: SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00232
V-270657CAT IIUbuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.Title, Check text
Title
Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DODDoW-defined auditable events and actions in near real time.
Check text
AND
- auditd is active
systemdunitproperty_test (check: all, existence: at_least_one_exists)
object systemdunitproperty_object: property equals "ActiveState"; unit equals "auditd.service"
state systemdunitproperty_state: value equals "active"
- auditd is running
systemdunitproperty_test (check: all, existence: at_least_one_exists)
object systemdunitproperty_object: property equals "SubState"; unit equals "auditd.service"
state systemdunitproperty_state: value equals "running"
Verify the audit service is enabled with the following command:
$ systemctl is-enabled auditd.service
enabled
If the command above returns "disabled", this is a finding.
Verify the audit service is properly running and active on the system with the following command:
$ systemctl is-active auditd.service
active
If the command above returns "inactive", this is a finding.
V-270662CAT IIUbuntu 24.04 LTS must have the "SSSD" package installed.Check text, Discussion
Check text
AND
- package sssd is installed
dpkginfo_test (check: all, existence: all_exist)
object dpkginfo_object: name equals "sssd"
- package libpam-sss is installed
dpkginfo_test (check: all, existence: all_exist)
object dpkginfo_object: name equals "libpam-sss"
- package ibnss-sss is installed
dpkginfo_test (check: all, existence: all_exist)
object dpkginfo_object: name equals "libnss-sss"
Verify Ubuntu 24.04 LTS has the packages required for multifactor authentication installed with the following command:
$ dpkg -l | grep sssd
ii sssd 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- metapackage
ii sssd-ad 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- Active Directory back end
ii sssd-ad-common 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- PAC responder
ii sssd-common 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- common files
ii sssd-ipa 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- IPA back end
ii sssd-krb5 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- Kerberos back end
ii sssd-krb5-common 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- Kerberos helpers
ii sssd-ldap 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- LDAP back end
ii sssd-proxy 2.9.4-1.1ubuntu6.1 amd64 System Security Services Daemon -- proxy back end
If the "sssd" package is not installed, this is a finding. The additional sssd components listed by the command may differ from configuration to configuration.
Ensure that "libpam-sss" (the PAM integration module for SSSD) is installed with the following command:
$ dpkg -l | grep libpam-sss
i libpam-sss:amd64 2.9.4-1.1ubuntu6.1 amd64 Pam module for the System Security Services Daemon
Ensure that "libnss-sss" (the NSS module for retrieving user and group information) is installed with the following command:
$ dpkg -l | grep libnss-sss
ii libnss-sss:amd64 2.9.4-1.1ubuntu6.1 amd64 Nss library for the System Security Services Daemon
Discussion
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased.
Multifactor authentication requires using two or more factors to achieve authentication.
Factors include:
1) Something a user knows (e.g., password/PIN);
2) Something a user has (e.g., cryptographic identification device, token); and
3) Something a user is (e.g., biometric).
A privileged account is defined as an information system account with authorizations of a privileged user.
Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet).
The DODDoW common access card (CAC) with DODDoW-approved PKI is an example of multifactor authentication.
Satisfies: SRG-OS-000705-GPOS-00150, SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160
V-270663CAT IIUbuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services.Check text, Discussion
Check text
AND
- sssd.service is active
systemdunitproperty_test (check: all, existence: at_least_one_exists)
object systemdunitproperty_object: property equals "ActiveState"; unit equals "sssd.service"
state systemdunitproperty_state: value equals "active"
- sssd.service is enabled
systemdunitproperty_test (check: all, existence: at_least_one_exists)
object systemdunitproperty_object: property equals "UnitFileState"; unit equals "sssd.service"
state systemdunitproperty_state: value equals "enabled"
Verify the "sssd.service" is enabled and active with the following commands:
$ sudo systemctl is-enabled sssd
enabled
$ sudo systemctl is-active sssd
active
If "sssd.service" is not active or enabled, this is a finding.
Discussion
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased.
Multifactor authentication requires using two or more factors to achieve authentication.
Factors include:
1) Something a user knows (e.g., password/PIN);
2) Something a user has (e.g., cryptographic identification device, token); and
3) Something a user is (e.g., biometric).
A privileged account is defined as an information system account with authorizations of a privileged user.
Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet).
The DODDoW common access card (CAC) with DODDoW-approved PKI is an example of multifactor authentication.
Satisfies: SRG-OS-000705-GPOS-00150, SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160
V-270667CAT IIUbuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.Check text, Discussion
Check text
AND
- /etc/ssh/sshd_config:Ciphers == DoDDoW-approved ciphers
textfilecontent54_test (check: all, existence: only_one_exists)
object textfilecontent54_object:
state textfilecontent54_state: subexpression pattern match "^(?:(aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr)|(aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes128-ctr,aes256-ctr)|(aes256-gcm@openssh.com,aes128-ctr,aes128-gcm@openssh.com,aes256-ctr)|(aes256-gcm@openssh.com,aes128-ctr,aes256-ctr,aes128-gcm@openssh.com)|(aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr)|(aes256-gcm@openssh.com,aes256-ctr,aes128-ctr,aes128-gcm@openssh.com)|(aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes128-ctr)|(aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes256-ctr)|(aes128-gcm@openssh.com,aes128-ctr,aes256-gcm@openssh.com,aes256-ctr)|(aes128-gcm@openssh.com,aes128-ctr,aes256-ctr,aes256-gcm@openssh.com)|(aes128-gcm@openssh.com,aes256-ctr,aes256-gcm@openssh.com,aes128-ctr)|(aes128-gcm@openssh.com,aes256-ctr,aes128-ctr,aes256-gcm@openssh.com)|(aes256-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes128-ctr)|(aes256-ctr,aes256-gcm@openssh.com,aes128-ctr,aes128-gcm@openssh.com)|(aes256-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com)|(aes256-ctr,aes128-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com)|(aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr)|(aes256-ctr,aes128-gcm@openssh.com,aes128-ctr,aes256-gcm@openssh.com)|(aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr)|(aes128-ctr,aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com)|(aes128-ctr,aes256-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com)|(aes128-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com)|(aes128-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes256-ctr)|(aes128-ctr,aes128-gcm@openssh.com,aes256-ctr,aes256-gcm@openssh.com))$"
Verify that the SSH daemon is configured to implement only FIPS-approved algorithms with the following command:
$ sudo grep -r 'Ciphers' /etc/ssh/sshd_config*
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
If any ciphers other than "Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr" are listed, the "Ciphers" keyword is missing, or the returned line is commented out, or if multiple conflicting ciphers are returned, this is a finding.
Discussion
Without cryptographic integrity protections, information can be altered by unauthorized users without detection.
Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network.
Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.
Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions that have common application in digital signatures, checksums, and message authentication codes.
Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000394-GPOS-00174, SRG-OS-000424-GPOS-00188
V-270668CAT IIUbuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.Check text, Discussion
Check text
AND
- oval:mil.disa.stig.ind:tst:26053200
textfilecontent54_test (check: all, existence: at_least_one_exists)
object textfilecontent54_object: filepath equals "/etc/ssh/sshd_config"; pattern pattern match "^\\s*MACs\\s+(\\S+)\\s*$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression equals "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
state textfilecontent54_state: subexpression equals "\"hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256\""
Verify the SSH daemon is configured to only use MACs that employ FIPS 140-3 approved ciphers with the following command:
$ grep -irs macs /etc/ssh/sshd_config*
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
If any algorithms other than "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256" are listed, the returned line is commented out, or if conflicting results are returned, this is a finding.
Discussion
Without cryptographic integrity protections, information can be altered by unauthorized users without detection.
Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network.
Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.
Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions that have common application in digital signatures, checksums, and message authentication codes.
Satisfies: SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000424-GPOS-00188
V-270670CAT IIUbuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.Check text, Discussion
Check text
AND
- /etc/ssh/ssh_config:Ciphers == DoDDoW-approved ciphers
textfilecontent54_test (check: all, existence: only_one_exists)
object textfilecontent54_object: filepath equals "/etc/ssh/ssh_config"; pattern pattern match "^\\s*(?i)Ciphers(?-i)[ \\t]+\\\"?([\\w,\\-@\\.]+)\\\"?[\\s]*(?:|(?:#.*))?$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "^(?:(aes256-gcm@openssh\\.com,aes128-gcm@openssh\\.com,aes256-ctr,aes128-ctr)|(aes256-gcm@openssh\\.com,aes128-gcm@openssh\\.com,aes256-ctr)|(aes256-gcm@openssh\\.com,aes128-gcm@openssh\\.com,aes128-ctr)|(aes256-gcm@openssh\\.com,aes256-ctr,aes128-ctr)|(aes128-gcm@openssh\\.com,aes256-ctr,aes128-ctr)|(aes256-gcm@openssh\\.com,aes128-gcm@openssh\\.com)|(aes256-gcm@openssh\\.com,aes256-ctr)|(aes256-gcm@openssh\\.com,aes128-ctr)|(aes128-gcm@openssh\\.com,aes256-ctr)|(aes128-gcm@openssh\\.com,aes128-ctr)|(aes256-ctr,aes128-ctr)|(aes256-gcm@openssh\\.com)|(aes128-gcm@openssh\\.com)|(aes256-ctr)|(aes128-ctr))$"
Verify the SSH client is configured to use only ciphers employing FIPS 140-3 approved algorithms with the following command:
$ sudo grep -r 'Ciphers' /etc/ssh/ssh_config*
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
If any ciphers other than "Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr" are listed, the "Ciphers" keyword is missing, or the returned line is commented out, or if multiple conflicting ciphers are returned, this is a finding.
Discussion
Without cryptographic integrity protections, information can be altered by unauthorized users without detection.
Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network.
Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.
Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions that have common application in digital signatures, checksums, and message authentication codes.
By specifying a cipher list with the order of ciphers being in a "strongest to weakest" orientation, the system will automatically attempt to use the strongest cipher for securing SSH connections.
V-270671CAT IIUbuntu 24.04 LTS SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.Check text, Discussion
Check text
AND
- oval:mil.disa.stig.ind:tst:27067100
textfilecontent54_test (check: all, existence: at_least_one_exists)
object textfilecontent54_object: filepath equals "/etc/ssh/ssh_config"; pattern pattern match "^\\s*MACs\\s+(\\S+)\\s*$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression equals "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
state textfilecontent54_state: subexpression equals "\"hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256\""
Verify the SSH client is configured to only use MACs employing FIPS 140-3 approved algorithms with the following command:
$ sudo grep -ir macs /etc/ssh/ssh_config*
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
If any MACs other than "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256" are listed, or the returned line is commented out, this is a finding.
Discussion
Without cryptographic integrity protections, information can be altered by unauthorized users without detection.
Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network.
Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.
Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions that have common application in digital signatures, checksums, and message authentication codes.
V-270672CAT IIUbuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials.Check text, Discussion
Check text
AND
- package opensc-pkcs11 is installed
dpkginfo_test (check: all, existence: all_exist)
object dpkginfo_object: name equals "opensc-pkcs11"
Verify the "opensc-pcks11" package is installed on the system with the following command:
$ dpkg -l | grep opensc-pkcs11
ii opensc-pkcs11:amd64 0.25.0~rc1-1build2 amd64 Smart card utilities with support for PKCS#15 compatible cards
If the "opensc-pcks11" package is not installed, this is a finding.
Discussion
The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.
DODDoW has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems.
V-270673CAT IIUbuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials managed through the Privileged Access Management (PAM) framework.Title, Check text, Discussion
Title
Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials managed through the Privileged Access Management (PAM) framework.
Check text
AND
- oval:mil.disa.stig.linux:tst:23823000
dpkginfo_test (check: all, existence: all_exist)
object dpkginfo_object: name equals "libpam-pkcs11"
Verify the "libpam-pcks11" package is installed on the system with the following command:
$ dpkg -l | grep libpam-pkcs11
ii libpam-pkcs11 0.6.12-2build3 amd64 Fully featured PAM module for using PKCS#11 smart cards
If the "libpam-pcks11" package is not installed, this is a finding.
Discussion
The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.
DODDoW has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems.
V-270675CAT IUbuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes.Check text, Discussion
Check text
AND
- /boot/grub/grub.cfg uses password_pbkdf2 for root
textfilecontent54_test (check: all, existence: all_exist)
object textfilecontent54_object: filepath equals "/boot/grub/grub.cfg"; pattern pattern match "^\\s*(password\\S*)\\s+root\\s+"; instance greater than or equal "1"
state textfilecontent54_state: subexpression equals "password_pbkdf2"
Verify Ubuntu 24.04 LTS requires a password for authentication upon booting into single-user and maintenance modes with the following command:
$ sudo grep -i password /boot/grub/grub.cfg
password_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG
If the root password entry does not begin with "password_pbkdf2", this is a finding.
Discussion
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DODDoW-approved PKIs, all DODDoW systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access.
Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.
V-270681CAT IIUbuntu 24.04 LTS must monitor remote access methods.Check text, Discussion
Check text
AND
- /etc/rsyslog.conf: auth.* is configured to be logged
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object:
- /etc/rsyslog.conf: authpriv.* is configured to be logged
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object:
- /etc/rsyslog.conf: daemon.* is configured to be logged
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object:
Verify that Ubuntu 24.04 LTS monitors all remote access methods with the following command:
$ grep -E -r '^(auth,authpriv\.\*|daemon\.\*)' /etc/rsyslog.*
/etc/rsyslog.d/50-default.conf:auth,authpriv.* /var/log/auth.log
If "auth.*", "authpriv.*", or "daemon.*" are not configured to be logged in at least one of the config files, this is a finding.
Discussion
Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk, and make remote user access management difficult at best.
Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Automated monitoring of remote access sessions allows organizations to detect cyberattacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).
V-270683CAT IIUbuntu 24.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.Check text, Fix text
Check text
AND
- /etc/default/useradd: INACTIVE is set to 35 or less, but not -1
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: filepath equals "/etc/default/useradd"; pattern pattern match "(?i)^\\s*INACTIVE\\s*=\\s*(-?\\d+)\\s*$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression greater than or equal "0"
state textfilecontent54_state: subexpression less than or equal "35"
Verify the account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity with the following command:
Check the account inactivity value by performing the following command:
$ grep INACTIVE /etc/default/useradd
INACTIVE=35
If "INACTIVE" is not set to a value 0<[VALUE]<=35, is commented out, or is missing, this is a finding.
Fix text
Configure Ubuntu 24.04 LTS to disable account identifiers after 35 days of inactivity after the password expiration.
Run the following command to change the configuration for adduser:
$ sudo useradd -D -f 35
Note: DODDoW recommendation is 35 days, but a lower value is acceptable. The value "0" will disable the account immediately after the password expires.
V-270692CAT IIUbuntu 24.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon.Title, Check text, Fix text, Discussion
Title
Ubuntu 24.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DODDoW Notice and Consent Banner before granting local access to the system via a graphical user logon.
Check text
AND
- /etc/gdm3/greeter.dconf-defaults has banner-message-enable set to true
textfilecontent54_test (check: all, existence: all_exist)
object textfilecontent54_object: filepath equals "/etc/gdm3/greeter.dconf-defaults"; pattern pattern match "^\\s*banner-message-enable\\s*=\\s*(\\w+)$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression equals "true"
Note: If the system does not have a graphical user interface installed, this requirement is not applicable.
Verify Ubuntu 24.04 LTS is configured to display the Standard Mandatory DOD Notice and Consent Banner before granting access to Ubuntu 24.04 LTS via a graphical user logon with the following command:
$ grep ^banner-message-enable /etc/gdm3/greeter.dconf-defaults
banner-message-enable=true
If the value for "banner-message-enable" is set to "false", the line is commented out, or no value is returned, this is a finding.
Fix text
Configure Ubuntu 24.04 LTS to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to Ubuntu 24.04 LTS via a graphical user logon.
Edit the "/etc/gdm3/greeter.dconf-defaults" file.
Look for the "banner-message-enable" parameter under the "[org/gnome/login-screen]" section and uncomment it (remove the leading "#" characters):
[org/gnome/login-screen]
banner-message-enable=true
Update the GDM with the new configuration:
$ sudo dconf update
$ sudo systemctl restart gdm3
Discussion
Display of a standardized and approved use notification before granting access to Ubuntu 24.04 LTS ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.
The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:
"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:
"I've read (literal ampersand) consent to terms in IS user agreem't."
V-270695CAT IIIUbuntu 24.04 LTS Advance Package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.Check text, Discussion
Check text
AND
- None of the AllowUnauthenticated settings in /etc/apt/apt.conf.d/* are set to true
textfilecontent54_test (check: all, existence: none_exist)
object textfilecontent54_object: pattern pattern match "^\\S+::AllowUnauthenticated\\s+\"true\";$"; path equals "/etc/apt/apt.conf.d"; filename pattern match ".*"; instance greater than or equal "1"
Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate recognized and approved by the organization with the following command:
$ grep AllowUnauthenticated /etc/apt/apt.conf.d/*
If any files are returned from the command with "AllowUnauthenticated" are set to "true", this is a finding.
Discussion
Changes to any software components can have significant effects on the overall security of Ubuntu 24.04 LTS. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.
Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.
Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Ubuntu 24.04 LTS will not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.
V-270721CAT IIUbuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.Check text, Discussion
Check text
AND
- /etc/pam.d/common-auth includes auth pam_pkcs11.so
textfilecontent54_test (check: all, existence: all_exist)
object textfilecontent54_object: filepath equals "/etc/pam.d/common-auth"; pattern pattern match "^\\s*auth\\s+.*pam_pkcs11\\.so\\s*$"; instance greater than or equal "1"
Verify that the "pam_pkcs11.so" module is configured with the following command:
$ grep -r pam_pkcs11.so /etc/pam.d/common-auth
auth [success=2 default=ignore] pam_pkcs11.so
If the module is not configured, is missing, or commented out, this is a finding.
Discussion
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased.
Multifactor authentication requires using two or more factors to achieve authentication.
Factors include:
1) Something a user knows (e.g., password/PIN);
2) Something a user has (e.g., cryptographic identification device, token); and
3) Something a user is (e.g., biometric).
A privileged account is defined as an information system account with authorizations of a privileged user.
Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet).
The DODDoW common access card (CAC) with DODDoW-approved PKI is an example of multifactor authentication.
Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000107-GPOS-00054, SRG-OS-000106-GPOS-00053, SRG-OS-000108-GPOS-00055
V-270722CAT IIUbuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts over SSH.Check text, Discussion
Check text
AND
OR
AND
- sshd_config includes sshd_config.d
textfilecontent54_test (check: at least one, existence: at_least_one_exists)
object textfilecontent54_object: pattern pattern match "^\\s*include\\s+(.*)\\s*$"; instance greater than or equal "1"; filepath equals "/etc/ssh/sshd_config"; behaviors equals ""
state textfilecontent54_state: subexpression equals "/etc/ssh/sshd_config.d/*.conf"
- /etc/ssh/sshd_config.d: PubkeyAuthentication is set to yes
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: pattern pattern match "^\\s*(?i)PubkeyAuthentication(?-i)[ \\t]+([\\w\\\"]+)[\\s]*(?:|(?:#.*))?$"; path equals "/etc/ssh/sshd_config.d"; filename pattern match "^.+\\.conf$"; instance greater than or equal "1"; behaviors equals ""
state textfilecontent54_state: subexpression pattern match "^(yes|\"yes\")$"
- /etc/ssh/sshd_config: PubkeyAuthentication is set to yes
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: pattern pattern match "^\\s*(?i)PubkeyAuthentication(?-i)[ \\t]+([\\w\\\"]+)[\\s]*(?:|(?:#.*))?$"; instance greater than or equal "1"; filepath equals "/etc/ssh/sshd_config"; behaviors equals ""
state textfilecontent54_state: subexpression pattern match "^(yes|\"yes\")$"
Verify the sshd daemon allows public key authentication with the following command:
$ sudo grep -r ^PubkeyAuthentication /etc/ssh/sshd_config*
/etc/ssh/sshd_config:PubkeyAuthentication yes
If "PubkeyAuthentication" is not set to "yes", is commented out, is missing, or conflicting results are returned, this is a finding.
Discussion
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased.
Multifactor authentication requires using two or more factors to achieve authentication.
Factors include:
1) Something a user knows (e.g., password/PIN);
2) Something a user has (e.g., cryptographic identification device, token); and
3) Something a user is (e.g., biometric).
A privileged account is defined as an information system account with authorizations of a privileged user.
Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet).
The DODDoW common access card (CAC) with DODDoW-approved PKI is an example of multifactor authentication.
Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000107-GPOS-00054, SRG-OS-000106-GPOS-00053, SRG-OS-000108-GPOS-00055
V-270723CAT IIUbuntu 24.04 LTS must electronically verify Personal Identity Verification (PIV) credentials.Check text, Discussion
Check text
AND
- Check pam_pkcs11.conf has all cert_policy set to include the ocsp_on option
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: filepath equals "/etc/pam_pkcs11/pam_pkcs11.conf"; pattern pattern match "^[\\s]*cert_policy[ \\t]+=[ \\t]+([\\w\\,\"' ]+);\\s*$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "^[\"']*ocsp_on[\"']*$|^[\"']*ocsp_on[\"',\\s]|[\"',\\s]ocsp_on[\"',\\s]|[\"',\\s]ocsp_on[\"']*$"
Verify Ubuntu 24.04 LTS electronically verifies PIV credentials via certificate status checking with the following command:
$ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy | grep ocsp_on
cert_policy = ca,signature,ocsp_on;
If every returned "cert_policy" line is not set to "ocsp_on", or the line is commented out, this is a finding.
Discussion
The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.
DODDoW has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems.
V-270731CAT IIUbuntu 24.04 LTS must be able to enforce a 180-day maximum password lifetime restriction.Title, Check text, Fix text, Discussion, CCIs
Title
Ubuntu 24.04 LTS must benforce a 60-day maximum password blifetime restriction. Passwords enfor ncew users must have a 6180-day maximum password lifetime restriction.
Check text
AND
- 0 -lt /etc/loginoval:mil.defsdisa.stig.ind:PASS_MAX_DAYS -le 60tst:25804100
textfilecontent54_test (check: all, existence: at_least_one_exists)
object textfilecontent54_object: filepath equals "/etc/login.defs"; pattern pattern match "^[ \\st]*PASS_MAX_DAYS[ \\st]+(\\d*+)[ \\t]*$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression lessgreater than or equal "600"
state textfilecontent54_state: subexpression greater than "0"
Verify Ubuntu 24.04 LTS enforces a 60-day maximum password lifetime for new user accounts with the following command:
$ grep -i ^PASS_MAX_DAYS /etc/login.defs
PASS_MAX_DAYS 60
If the "PASS_MAX_DAYS" parameter value is less than "60" or isequal commented out, this is a finding."180"
Fix text
Configure Ubuntu 24.04 LTS to set noncompliant accounts to enforce a 60180-day maximum password lifetime. restriction.
Add$ orsudo modifychage the-M following180 line in the "/etc/login.defs" file:
PASS_MAX_DAYS 60[user]
Discussion
Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If Ubuntu 24.04 LTS does not limit the lifetime of passwords and force users to change their passwords, there is the risk that Ubuntu 24.04 LTS passwords could be compromised.
Satisfies: SRG-OS-000076-GPOS-00044, SRG-OS-000730-GPOS-00190
CCIs
CCI-004065,CCI-004066CCI-004066
V-270757CAT IIUbuntu 24.04 LTS must generate system journal entries without revealing information that could be exploited by adversaries.Check text, Fix text
Check text
AND
- Mode of /run/log/journal directory is 06402755 or less permissive
file_test (check: all, existence: )
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000021"; path equals "/run/log/journal"; filename equals ""
state file_state: gexec equals "false"; oreadbehaviors equals "false";
state uexecfile_state: equals "false"; sticky equals "false"; sgid equals "false"; suid equals "false"; oexec equals "false"; owrite equals "false"; gwrite equals "false"
- Mode of /var/log/journal directory is 06402755 or less permissive
file_test (check: all, existence: )
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000021"; path equals "/var/log/journal"; filename equals ""
state file_state: gexec equals "false"; oreadbehaviors equals "false";
state uexecfile_state: equals "false"; sticky equals "false"; sgid equals "false"; suid equals "false"; oexec equals "false"; owrite equals "false"; gwrite equals "false"
- All files in /run/log/journal is mode 0640 or less permissive
file_test (check: all, existence: any_exist)
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000015"; path equals "/run/log/journal"; behaviors equals ""; filename pattern match ".*"; behaviors equals ""
state file_state: gexec equals "false"; oread equals "false"; uexec equals "false"; sticky equals "false"; sgid equals "false"; suid equals "false"; oexec equals "false"; owrite equals "false"; gwrite equals "false"
- All files in /var/log/journal is mode 0640 or less permissive
file_test (check: all, existence: any_exist)
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000015"; path equals "/var/log/journal"; behaviors equals ""; filename pattern match ".*"; behaviors equals ""
state file_state: gexec equals "false"; oread equals "false"; uexec equals "false"; sticky equals "false"; sgid equals "false"; suid equals "false"; oexec equals "false"; owrite equals "false"; gwrite equals "false"
Verify the /run/log/journal and /var/log/journal directories have permissions set to "640" or less permissive with the following command:
$ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %a" {} \;
/run/log/journal 640
/var/log/journal 640
/var/log/journal/6a52424faa6e480ea5fc7346b9345792 640
If any output returned has a permission set greater than 640, this is a finding.
Verify all files in the /run/log/journal and /var/log/journal directories have permissions set to "640" or less permissive with the following command:
$ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %a" {} \;
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/system.journal 640
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/user-1000@0005f97cd4a8c9b5a.journal~ 640
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/system@0005f97cd2a1e0a7-d58b848af46813a4.journal~ 640
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/system@0005f97cb900e501-55ea053b7f75ae1c.journal~ 640
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/user-1000.journal 640
If any output returned has a permission set greater than "640", this is a finding.
Fix text
Configure the system to set the appropriate permissions to the files and directories used by the systemd journal.
Create a drop-in file if it does not already exist with the following command:
$ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file:
z /run/log/journal 06402755 root systemd-journal - -
Z /run/log/journal/%m ~06402750 root systemd-journal - -
z /var/log/journal 06402755 root systemd-journal - -
z /var/log/journal/%m 06402755 root systemd-journal - -
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
Note: Restart the system for these settings to take effect.
V-270761CAT IIUbuntu 24.04 LTS must configure the directories used by the system journal to be group-owned by "systemd-journal".Check text, Fix text
Check text
AND
- /run/log/journal, and subdirectories thereof, are group-owned by systemd-journal
file_test (check: all, existence: )
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000021"; path equals "/run/log/journal"; filename equals ""; behaviors equals ""
state file_state: group_id equals ""
- /var/log/journal, and subdirectories thereof, are group-owned by systemd-journal
file_test (check: all, existence: )
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000021"; path equals "/var/log/journal"; filename equals ""; behaviors equals ""
state file_state: group_id equals ""
Verify the /run/log/journal and /var/log/journal directories are group-owned by "systemd-journal" with the following command:
$ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %G" {} \;
/run/log/journal systemd-journal
/var/log/journal systemd-journal
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e systemd-journal
If any output returned is not group-owned by "systemd-journal", this is a finding.
Fix text
Configure the system to set the appropriate group-ownership to the directories used by the systemd journal.
Create a drop-in file if it does not already exist with the following command:
$ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file:
z /run/log/journal 06402755 root systemd-journal - -
Z /run/log/journal/%m ~2750 root systemd-journal - -
z /var/log/journal 2755 root systemd-journal - -
z /var/log/journal/%m 2755 root systemd-journal - -
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
Note: Restart the system for these settings to take effect.
V-270763CAT IIUbuntu 24.04 LTS must configure the directories used by the system journal to be owned by "root".Check text, Fix text
Check text
AND
- /run/log/journal, and subdirectories thereof, are owned by root
file_test (check: all, existence: )
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000021"; path equals "/run/log/journal"; filename equals ""; behaviors equals ""
state file_state: user_id equals "0"
- /var/log/journal, and subdirectories thereof, are owned by root
file_test (check: all, existence: )
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000021"; path equals "/var/log/journal"; filename equals ""; behaviors equals ""
state file_state: user_id equals "0"
Verify the /run/log/journal and /var/log/journal directories are owned by "root" with the following command:
$ sudo find /run/log/journal /var/log/journal -type d -exec stat -c "%n %U" {} \;
/run/log/journal root
/var/log/journal root
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e root
If any output returned is not owned by "root", this is a finding.
Fix text
Configure the system to set the appropriate ownership to the directories used by the systemd journal.
Create a drop-in file if it does not already exist with the following command:
$ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file:
z /run/log/journal 06402755 root systemd-journal - -
Z /run/log/journal/%m ~2750 root systemd-journal - -
z /var/log/journal 2755 root systemd-journal - -
z /var/log/journal/%m 2755 root systemd-journal - -
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
Note: Restart the system for these settings to take effect.
V-270764CAT IIUbuntu 24.04 LTS must configure the files used by the system journal to be owned by "root"Check text, Fix text
Check text
AND
- Files in /run/log/journal (recursively) are owned by root
file_test (check: all, existence: any_exist)
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000015"; path equals "/run/log/journal"; filename pattern match ".*"; behaviors equals ""
state file_state: user_id equals "0"
- Files in /var/log/journal (recursively) are owned by root
file_test (check: all, existence: any_exist)
object file_object: filter equals "oval:mil.disa.stig.unix:ste:20000015"; path equals "/var/log/journal"; filename pattern match ".*"; behaviors equals ""
state file_state: user_id equals "0"
Verify the /run/log/journal and /var/log/journal files are owned by "root" with the following command:
$ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %U" {} \;
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/system.journal root
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/user-1000@0005f97cd4a8c9b5-f088232c3718485a.journal~ root
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/system@0005f97cd2a1e0a7-d58b848af46813a4.journal~ root
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/system@0005f97cb900e501-55ea053b7f75ae1c.journal~ root
/var/log/journal/d5745ad455d34fb8b6f78be37c1fcd3e/user-1000.journal root
If any output returned is not owned by "root", this is a finding.
Fix text
Configure the system to set the appropriate ownership to the files used by the systemd journal.
Create a drop-in file if it does not already exist with the following command:
$ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file:
z /run/log/journal 2755 root systemd-journal - -
Z /run/log/journal/%m ~06402750 root systemd-journal - -
z /var/log/journal 2755 root systemd-journal - -
z /var/log/journal/%m 06402755 root systemd-journal - -
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
Note: Restart the system for these settings to take effect.
V-270831CAT IIUbuntu 24.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools.Check text, Fix text
Check text
AND
- oval:mil/etc/aide/aide.disaconf.stigd/* includes the compliant rule for /sbin/auditctl.ind:tst:23830300
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: filepath equals "/etc/aide/aide.conf"; pattern pattern match "^\\s*\\/sbin\\/auditctl\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- oval:mil/etc/aide/aide.disaconf.stigd/* includes the compliant rule for /sbin/auditd.ind:tst:23830301
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: filepath equals "/etc/aide/aide.conf"; pattern pattern match "^\\s*\\/sbin\\/auditd\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- oval:mil/etc/aide/aide.disaconf.stigd/* includes the compliant rule for /sbin/ausearch.ind:tst:23830302
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: filepath equals "/etc/aide/aide.conf"; pattern pattern match "^\\s*\\/sbin\\/ausearch\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- oval:mil/etc/aide/aide.disaconf.stigd/* includes the compliant rule for /sbin/aureport.ind:tst:23830303
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: filepath equals "/etc/aide/aide.conf"; pattern pattern match "^\\s*\\/sbin\\/aureport\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- oval:mil/etc/aide/aide.disaconf.stigd/* includes the compliant rule for /sbin/autrace.ind:tst:23830304
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: filepath equals "/etc/aide/aide.conf"; pattern pattern match "^\\s*\\/sbin\\/autrace\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- oval:mil/etc/aide/aide.disaconf.stigd/* includes the compliant rule for /sbin/augenrules.ind:tst:23830305
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: filepath equals "/etc/aide/aide.conf"; pattern pattern match "^\\s*\\/sbin\\/augenrules\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
Verify state thattextfilecontent54_state: Advancedsubexpression Intrusionpattern Detectionmatch Environment"p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- (AIDE)/etc/aide/aide.conf.d/* isincludes properly configured to use cryptographic mechanisms to protect the integritycompliant ofrule auditfor tools/usr/sbin/auditctl.
textfilecontent54_test with(check: theall, following commandexistence: )
object
$textfilecontent54_object: egreppattern '(pattern match "^\\s*\\/usr\\/sbin\\/auditctl\\s+(audit|au\\S+))'"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
/sbin/auditctl state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- /etc/aide/aide.conf.d/* includes the compliant rule for /usr/sbin/auditd.
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: pattern pattern match "^\\s*\\/usr\\/sbin\\/auditd\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- /etc/aide/aide.conf.d/* includes the compliant rule for /usr/sbin/ausearch.
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: pattern pattern match "^\\s*\\/usr\\/sbin\\/ausearch\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- /etc/aide/aide.conf.d/* includes the compliant rule for /usr/sbin/aureport.
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: pattern pattern match "^\\s*\\/usr\\/sbin\\/aureport\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
- /etc/aide/aide.conf.d/* includes the compliant rule for /usr/sbin/autrace.
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: pattern pattern match "^\\s*\\/usr\\/sbin\\/autrace\\s+(\\S+)"; path equals "/etc/aide/aide.conf.d"; filename pattern match "^.+$"; instance greater than or equal "1"
state textfilecontent54_state: subexpression pattern match "p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512 "
- /etc/aide/aide.conf.d/* includes the compliant rule for /usr/sbin/augenrules.
textfilecontent54_test p+i+n+u+g+(check: all, existence: )
object textfilecontent54_object: pattern pattern match "^\\s*\\/usr\\/sbin\\/augenrules\\s+b(\\S+acl+xattrs+sha512)";
path
Ifequals any"/etc/aide/aide.conf.d"; offilename thepattern sevenmatch audit"^.+$"; toolsinstance dogreater notthan haveor appropriateequal selection"1"
state lines,textfilecontent54_state: thissubexpression ispattern amatch finding."p\\+i\\+n\\+u\\+g\\+s\\+b\\+acl\\+xattrs\\+sha512"
Fix text
AddConfigure orAIDE updateto protect the integrity of the audit tools by performing the following selectionsteps:
Create linesa fordedicated "configuration file inside AIDE's sub-configuration directory:
$ sudo nano /etc/aide/aide.conf".d/90-stig_audit_tools
Add toconfiguration protectrules:
# theModern integrityCanonical ofPaths
/usr/sbin/auditctl thep+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd auditp+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch tools:p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
# AuditLegacy Tools Paths
/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
If the legacy "/sbin/" paths are defined inside the main "/etc/aide/aide.conf" file, edit "/etc/aide/aide.conf" and comment those lines out using a "#" to prevent duplicate definition conflicts.
Validate the modified AIDE configuration to ensure no syntax warnings or errors are present:
$ sudo aide -c /etc/aide/aide.conf --config-check
This command should return no output.
Initialize the updated baseline database (this may take a few minutes):
$ sudo aideinit
Copy the newly generated database into the production directory:
$ sudo cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
V-270832CAT IIUbuntu 24.04 LTS audit system must protect auditing rules from unauthorized change.Check text, Fix text
Check text
AND
- /etc/audit/auditrules.d/*.rules: -e 2 option is present and is the last line in the file
textfilecontent54_test (check: all, existence: )
object textfilecontent54_object: pattern pattern match "\\n[ \\t]*-e[ \\t]+2\\s*$"; instancepath greater than or equal "1"; filepath equals "/etc/audit/audit.rules.d"; behaviorsfilename equalspattern ""
Verifymatch the audit system prevents unauthorized changes to the rules with the following command:
$ grep -E '"^-e 2' /etc/audit/audit.+\\.rules
-e$"; 2
Ifinstance thegreater auditthan systemor isequal not set to be immutable by adding the "-e 21"; optionbehaviors toequals the end of "/etc/audit/audit.rules", this is a finding.
Fix text
Configure the audit system to set the audit rules to be immutable by addingperforming the following linesteps:
Create toor theedit enda offinalized rules file (e.g., "/etc/audit/rules.d/audit99-finalize.rules") and append the following option as the absolute last line:
-e 2
Compile and load the new rules into the active kernel:
$ sudo augenrules --load
Note: Once this rule is active, further changes to the audit configuration will be blocked. A system reboot will be required to apply any future audit rule modifications.
V-274870CAT IIUbuntu 24.04 LTS must audit any script or executable called by cron as root or by any privileged user.Check text, Fix text
Check text
AND
- Audit modifications to /etc/cron.d
textfilecontent54_test (check: all, existence: all_exist)
object textfilecontent54_object: filepath equals "/etc/audit/audit.rules"; pattern pattern match "^\\s*-w\\s+/etc/cron\\.d(\\s+-p\\s*([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*))?(\\s+(-k\\s+|-F\\s+key=)\\w+)?\\s*$"; instance greater than or equal "1"
- Audit modifications to /var/spool/cron
textfilecontent54_test (check: all, existence: all_exist)
object textfilecontent54_object: filepath equals "/etc/audit/audit.rules"; pattern pattern match "^\\s*-w\\s+/var/spool/cron(\\s+-p\\s*([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*))?(\\s+(-k\\s+|-F\\s+key=)\\w+)?\\s*$"; instance greater than or equal "1"
Verify Ubuntu 24.04 LTS is configured to audit the execution of any system call made by cron as root or as any privileged user.
$ sudo auditctl -l | grep /etc/cron.d
-w /etc/cron.d -p wa -k cronjobs
$ sudo auditctl -l | grep /var/spool/cron
-w /var/spool/cron -p wa -k cronjobs
If either of these commands does not return the expected output, or the lines are commented out, this is a finding.
Fix text
Configure Ubuntu 24.04 LTS to audit the execution of any system call made by cron as root or as any privileged user.
Add or update the following file system rules to "/etc/audit/rules.d/auditstig.rules":
-w /etc/cron.d/ -p wa -k cronjobs
-w /var/spool/cron/ -p wa -k cronjobs
To load the rules to the kernel immediately, use the following command:
$ sudo augenrules --load
How these changes are found
Rules are matched across the two benchmark releases by their STIG V-number. A rule counts as updated when its rule id changed and its title, severity, discussion, fix text or OVAL check logic changed — the same comparison SCAP Compare makes.
Comparing other releases, or this one against an older release? Pick any two in SCAP Compare.