What changed in Red Hat Enterprise Linux 10 SCAP Benchmark V1R1V1R1 changes

Check text

AND - /etc/dnf/dnf.conf gpgcheck=1 textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: filepath equals "/etc/dnf/dnf.conf"; pattern pattern match "^gpgcheck=(.*)$"; instance greater than or equal "1" state textfilecontent54_state: subexpression equalspattern match "(?i)^(True|1|yes)$"

Fix text

Configure RHEL 10 dnf to always check the GPG signature of software packages originating from external software repositories before installation. Add or update the following line in the [main] section of the "/etc/dnf/dnf.conf" file: gpgcheck=1 Note: Any of the following are acceptable: "1", "true", or "yes" (keywords containing letters are case insensitive).

V-280932 in V1R1

Fix text

Configure RHEL 10 dnf to always check the GPG signature of local software packages before installation. Add or update the following line in the [main] section of the "/etc/dnf/dnf.conf" file: localpkg_gpgcheck=1 Note: Any of the following are acceptable: "1", "true", or "yes" (keywords containing letters are case insensitive).

V-280933 in V1R1

Fix text

Configure RHEL 10 software repositories defined in "/etc/yum.repos.d/" to have "gpgcheck" enabled with the following command: $ sudo sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/* Note: Any of the following are acceptable: "1", "true", or "yes" (keywords containing letters are case insensitive).

V-280934 in V1R1

Fix text

Configure RHEL 10 to not have the FTP package installed with the following command (using "vsftpd" as an example): $ sudo dnf -y remove vsftpd

V-280951 in V1R1

Discussion

The use of Personal Identity Verification (PIV) credentials facilitates standardization and reduces the risk of unauthorized access. The DODDoW has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161

V-280975 in V1R1

Fix text

Configure RHEL 10 to have the "rsyslogd" package installed with the following command: $ sudo dnf -y install rsyslogd

V-280983 in V1R1

Fix text

Configure RHEL 10 to have the "openssl-pkcs11-provider" package installed with the following command: $ sudo dnf -y install pkcs11-provider

Discussion

Without the use of multifactor authentication (MFA), the ease of access to privileged functions is greatly increased. MultifactorMFA authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DODDoW common access card (CAC) with DODDoW-approved PKI is an example of multifactor authenticationMFA. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000377-GPOS-00162

V-281005 in V1R1

Title

RHEL 10 must be configured so that Secure Shell (SSH) clients use only DODDoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., Remote Desktop Protocol [RDP]) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganizational-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions that use asymmetric cryptography. This enables distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/openssh.config" file. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000423-GPOS-00187

V-281010 in V1R1

Title

RHEL 10 must be configured so that Secure Shell (SSH) servers use only DODDoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Discussion

Without cryptographic integrity protections, unauthorized users can alter information without detection. Remote access (e.g., Remote Desktop Protocol [RDP]) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganizational-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions that use asymmetric cryptography. This enables distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/opensshserver.config" file. Satisfies: SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093

V-281011 in V1R1

Title

RHEL 10 must be configured so that Secure Shell (SSH) clients use only DODDoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., Remote Desktop Protocol [RDP]) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganizational-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions that use asymmetric cryptography. This enables distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/openssh.config" file. Satisfies: SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093

V-281012 in V1R1

Title

RHEL 10 must be configured so that Secure Shell (SSH) servers use only DODDoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., Remote Desktop Protocol [RDP]) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. RHEL 10 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the "/etc/sysconfig/sshd" file. The employed algorithms can be viewed in the "/etc/crypto-policies/back-ends/opensshserver.config" file. Satisfies: SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093

V-281013 in V1R1

Title

RHEL 10 must implement DODoW-approved encryption in the bind package.

V-281015 in V1R1

Check text

AND - Audit 32-bit invocations of /usr/bin/gpasswd textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/etc/audit/audit.rules"; pattern pattern match "^\\s*-a\\s+(always,exit|exit,always)(?:\\s+-S\\s+all)?\\s+-F\\s+arch=b32?\\s+-F\\s+path=/usr/bin/gpasswd\\s+(-F\\s+perm=([rwa]*x[rwa]*)\\s+)?-F\\s+auid>=1000\\s+-F\\s+auid!=(4294967295|-1|unset)(\\s+(-k\\s+|-F\\s+key=)\\S+)?\\s*$"; instance greater than or equal "1" - Audit 64-bit invocations of /usr/bin/gpasswd textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/etc/audit/audit.rules"; pattern pattern match "^\\s*-a\\s+(always,exit|exit,always)(?:\\s+-S\\s+all)?\\s+-F\\s+arch=b64?\\s+-F\\s+path=/usr/bin/gpasswd\\s+(-F\\s+perm=([rwa]*x[rwa]*)\\s+)?-F\\s+auid>=1000\\s+-F\\s+auid!=(4294967295|-1|unset)(\\s+(-k\\s+|-F\\s+key=)\\S+)?\\s*$"; instance greater than or equal "1"

Fix text

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "gpasswd" command by adding or updating the following rulerules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd -a always,exit -F auid>arch=1000b64 -F auid!path=unset/usr/bin/gpasswd -F perm=x -k privileged-gpasswd RestartTo load the auditrules daemonto with the followingkernel commandimmediately, foruse the changesfollowing to take effectcommand: $ sudo serviceaugenrules auditd restart--load

V-281131 in V1R1

Check text

AND - Audit 32-bit invocations of /usr/bin/passwd textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/etc/audit/audit.rules"; pattern pattern match "^\\s*-a\\s+(always,exit|exit,always)(?:\\s+-SF\\s+all)?arch=b32\\s+-F\\s+path=/usr/bin/passwd\\s+(?:-F\\s+auid>=1000\\s+-F\\s+auid!=(4294967295|-1|unset))?\\s*(-F\\s+perm=([rwa]*x[rwa]*))(\\s+(-k\\s+|-F\\s+key=)[-\\w]+)*\\s*$"; instance greater than or equal "1" - Audit 64-bit invocations of /usr/bin/passwd textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/etc/audit/audit.rules"; pattern pattern match "^\\s*-a\\s+(always,exit|exit,always)\\s+-F\\s+arch=b64\\s+-F\\s+path=/usr/bin/passwd\\s+(?:-F\\s+auid>=1000\\s+-F\\s+auid!=(4294967295|-1|unset))?\\s*(-F\\s+perm=([rwa]*x[rwa]*))(\\s+(-k\\s+|-F\\s+key=)[-\\Sw]+)?*\\s*$"; instance greater than or equal "1"

Fix text

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "passwd" command by adding or updating the following rulerules in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -k privileged-passwd -a always,exit -F auid>arch=1000b64 -F auid!path=unset/usr/bin/passwd -F perm=x -k privileged-passwd RestartTo load the auditrules daemonto with the followingkernel commandimmediately, foruse the changesfollowing to take effectcommand: $ sudo serviceaugenrules auditd restart--load

V-281135 in V1R1

Fix text

Configure RHEL 10 to generate audit records upon successful and unsuccessful attempts to use the "mount" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k exportprivileged-mount -a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k exportprivileged-mount Restart the audit daemon with the following command for the changes to take effect: $ sudo service auditd restart

V-281147 in V1R1

Fix text

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers". Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=loginsidentity -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=loginsidentity Restart the audit daemon with the following command for the changes to take effect: $ sudo serviceaugenrules auditd restart--load

V-281154 in V1R1

Title

RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd".

Fix text

Configure RHEL 10 to generate audit records for all account creations, modifications, disabling,to and termination events that affect "/etc/security/opasswd". Add by adding or updateupdating the following filerules systemin rule to "/etc/audit/rules.d/auditidentity.rules": -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -Fk key=identity -a always,exit -F arch=b64 -F path=(/etc/security/opasswd -F perm=wa -Fk key=identity RestartTo load the auditrules daemonto with the followingkernel commandimmediately, foruse the changesfollowing to take effectcommand: $ sudo serviceaugenrules auditd restart--load

V-281158 in V1R1

Title

RHEL 10 must require a boot loader superuser password.RHEL 10 must require authentication upon booting into single-user and maintenance modes.

Check text

AND - /etc/grub2.cfg:superusers exists and has a name. textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/etc/grub2.cfg"; pattern pattern match "^\\s*set\\s+superusers\\s*=\\s*\"(\\S+)\"\\s*$"; instance greater than or equal "1" state textfilecontent54_state: subexpression pattern match "^\\S+$" OR - /boot/grub2/user.cfg:GRUB2_PASSWORD exists and has a PBKDF2/SHA512 password assigned. textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/boot/grub2/user.cfg"; pattern pattern match "^\\s*GRUB2_PASSWORD=(\\S+)\\b"; instance greater than or equal "1" state textfilecontent54_state: subexpression pattern match "^grub\\.pbkdf2\\.sha512\\." - /boot/efi/EFI/redhat/user.cfg:GRUB2_PASSWORD exists and has a PBKDF2/SHA512 password assigned. textfilecontent54_test (check: all, existence: all_exist) object textfilecontent54_object: filepath equals "/boot/efi/EFI/redhat/user.cfg"; pattern pattern match "^\\s*GRUB2_PASSWORD=(\\S+)\\b"; instance greater than or equal "1" state textfilecontent54_state: subexpression pattern match "^grub\\.pbkdf2\\.sha512\\."

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DODDoW-approved PKIs, all DODDoW systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use and whether to enter single-user mode.

V-281166 in V1R1

Fix text

Configure RHEL 10 so that all noninteractive accounts on the system do not have an interactive shell assigned to them. If the system account needs a shell assigned for mission operations, document the need with the information system security officer (ISSO). Run the following command to disable the interactive shell for a specific noninteractive user account: Replace <user> with the user that has a login shell. $ sudo usermod --shell /usr/sbin/nologin <user> Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.

V-281168 in V1R1

Title

RHEL 10 muser account, passwords for new users or password changes, must have a 6180-day maximum password lifetime restriction for user account passwords in "/etc/login.defs".

Check text

AND - oval:mil.disa.stig.ind:tst:25804100 textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: filepath equals "/etc/login.defs"; pattern pattern match "^[ \\st]*PASS_MAX_DAYS[ \\st]+(\\d+)[ \\t]*$"; instance greater than or equal "1" state textfilecontent54_state: subexpression greater than "0" state textfilecontent54_state: subexpression less than or equal "60180"

Fix text

Configure RHEL 10 to enforce a 6180-day maximum password lifetime. Add, or modify the following line in the "/etc/login.defs" file: PASS_MAX_DAYS 6180

Discussion

Any password, no matter how complex, can eventually be cracked; therefore, passwords mustneed to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.

V-281169 in V1R1

Discussion

The shorter the password, the lower the number of possible combinations that must be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password. RHEL 10 uses "pwquality" as a mechanism to enforce password complexity. Configurations are set in the "etc/security/pwquality.conf" file. The "minlen", sometimes noted as minimum length, acts as a "score" of complexity based on the credit components of the "pwquality" module. By setting the credit components to a negative value, those components will not only be required but will not count toward the total "score" of "minlen". This will enable "minlen" to require a 15-character minimum. The DODDoW minimum password requirement is 15 characters.

V-281181 in V1R1

Discussion

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified; therefore, they cannot be relied on to provide confidentiality or integrity, and DODDoW data may be compromised. RHEL 10 systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DODDoW requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

V-281217 in V1R1

Discussion

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied on to provide confidentiality or integrity, and DODDoW data may be compromised. RHEL 10 systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DODDoW requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

V-281219 in V1R1

Discussion

Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult. The default for Red Hat 10 is yescrypt. Although yescrypt is structurally built using an outer layer of SHA-256 (which is a NIST-approved algorithm), the yescrypt algorithm as a whole is not recognized or validated by the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP).

V-281222 in V1R1

Fix text

Configure RHEL 10 to use the SHA-512 algorithm for password hashing. Add or change the following line in the "[defaultdefaults]" section of the "/etc/libuser.conf" file: crypt_style = sha512

V-281223 in V1R1

Title

RHEL 10 must display the Standard Mandatory DODoW Notice and Consent Banner before granting local or remote access to the system via a Secure Shell (SSH) login.

Fix text

Configure RHEL 10 to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system via SSH. Edit a file in "/etc/ssh/sshd_config.d" to uncomment or add the banner keyword and configure it to point to a file that will contain the login banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: Banner /etc/issue

V-281224 in V1R1

Discussion

This requirement applies to wireless peripheral technologies (e.g., wireless mice, keyboards, displays, etc.) used with RHEL 10 systems. Wireless peripherals (e.g., Wi-Fi/Bluetooth/IR keyboards, mice and pointing devices, and near field communications [NFC]) present a unique challenge by creating an open, unsecured port on a computer. Wireless peripherals must meet DODDoW requirements for wireless data transmission and be approved for use by the authorizing official. Even though some wireless peripherals, such as mice and pointing devices, do not ordinarily carry information that must be protected, modification of communications with these wireless peripherals may be used to compromise the RHEL 10 operating system. Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000300-GPOS-00118

V-281289 in V1R1

Title

RHEL 10 must automatically exit interactive command shell user sessions after 150 minutes of inactivity.

V-281295 in V1R1

Fix text

Configure RHEL 10 to disable the "CtrlAltDelBurstAction". Update theby adding it to a drop file in a "/etc/systemd/system.conf.d/" configuration file: If asno followsdrop file exists, create one with the following command: $ sudo mkdir -p /etc/systemd/system.conf.d && sudo vi /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf Edit the file to contain the setting by adding the following text: [Manager] CtrlAltDelBurstAction=none Reload the daemon for this change to take effect:. $ sudo systemctl daemon-reload

V-281298 in V1R1

Discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of information system components that are, or use, such products. This can be verified by acceptance/validation processes in DODDoW or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Restricting access to the kernel message buffer limits access to only root. This prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069

V-281305 in V1R1

Discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of information system components that are, or use, such products. This can be verified by acceptance/validation processes in DODDoW or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components. Setting the "kernel.perf_event_paranoid" kernel parameter to "2" prevents attackers from gaining additional system information as a nonprivileged user. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069

V-281306 in V1R1