What changed in SUSE Linux Enterprise Server 12 SCAP Benchmark V3R5V3R5 changes

SUSE Linux Enterprise Server 12 SCAP Benchmark V3R5 (2026-02-19) replaced V3R4 (2025-11-24): 3 rules added, 2 updated. It has 114 rules, against 111 in V3R4.

V3R5 benchmarkV3R4 benchmark Compare V3R4 and V3R5 in SCAP Compare

  • 3 added
  • 0 removed
  • 2 updated

Updated fields: Check text 2Discussion 1

Added in V3R5 (3)

  • V-217175CAT IIAll SUSE operating system local initialization files must have mode 0740 or less permissive.
  • V-255914CAT IIThe SUSE operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
  • V-255915CAT IIIThe SUSE operating system must restrict access to the kernel message buffer.

Updated in V3R5 (2)

V-217101CAT IThe SUSE operating system must be a vendor-supported release.Check text, Discussion

Check text

AND - SLES 12 has reached End of General Support. textfilecontent54_test (check: all, existence: at_least_one_exists) object textfilecontent54_object: pattern pattern match "^CPE_NAME=\"cpe:/o:suse:sles:12.*\"$"; path equals "/etc"; filename equals "os-release"; instance equals "1" Verify the SUSE operating system is a vendor-supported release. Use the following command to verify the SUSE operating system is a vendor-supported release: # cat /etc/os-release NAME="SLES" VERSION="12" Current End of Life for SLES 12 General Support iswas 31 Oct 2024 and Long-term Support isends until 31 Oct 2027. If the release is not supported by the vendor, this is a finding.

Discussion

A SUSE operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it willis not be possible to resolve security issues discovered in the system software. Release Released General Support Long Term Support 12.1 15 Dec 2015 31 May 2017 31 May 2020 12.2 08 Nov 2016 31 Mar 2018 31 Mar 2021 12.3 07 Sep 2017 30 Jun 2019 30 Jun 2022 12.4 12 Dec 2018 30 Jun 2020 30 Jun 2023 12.5 09 Dec 2019 31 Oct 2024 31 Oct 2027

V-217101 in V3R5

V-217129CAT IIThe SUSE operating system must employ user passwords with a minimum lifetime of 24 hours (one day).Check text

Check text

AND - No /etc/shadow line has a minimum password age of 0 textfilecontent54_test (check: all, existence: none_exist) object textfilecontent54_object: filepath equals "/etc/shadow"; pattern pattern match "^[^:]+:[^:]+:[^:]+:0+:"; instance greater than or equal "1" Verify the SUSE operating system enforces a minimum time period between password changes for each user account of one day or greater. Check the minimum time period between password changes for each user account with the following command: > sudo awk -F: '$4 < 1 {print $1 ":" $4}' /etc/shadow smithjdosuser:1 If any results are returned that are not associated with a system account, this is a finding.

V-217129 in V3R5

How these changes are found

Rules are matched across the two benchmark releases by their STIG V-number. A rule counts as updated when its rule id changed and its title, severity, discussion, fix text or OVAL check logic changed — the same comparison SCAP Compare makes.

Comparing other releases, or this one against an older release? Pick any two in SCAP Compare.