What changed in Canonical Ubuntu 16.04 LTS STIG V2R3V2R3 changes

Check text

Verify the version of the Ubuntu operating system is vendor supported. Check the version of the Ubuntu operating system with the following command: # cat /etc/lsb-release DISTRIB_RELEASE=16.04 DISTRIB_CODENAME=xenial DISTRIB_DESCRIPTION="Ubuntu 16.04.1 LTS" CurrentValidate Endthat of"Extended LifeSecurity forMaintenance" Ubuntusupport 16.04has LTSbeen ispurchased Aprilfrom 2021the vendor. If the releaseoperating issystem does not supportedhave bya thedocumented vendor"Extended Security Maintenance" agreement in place, this is a finding.

V-214939 in V2R3

Check text

Verify the assigned home directory of all local interactive users on the Ubuntu operating system exists. Check the home directory assignment for all local interactive non-privileged users with the following command: #$ lssudo -ld $(awk -F: '($3>=1000)&&($17 !="nobody"~ /nologin/){print $1, $3, $6}' /etc/passwd) drwxr-xr-x 2 smithj admin1001 4096 Jun 5 12:41 /home/smithj Note: This may miss interactive users that have been assigned a privileged User ID (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. Check that all referenced home directories exist with the following command: #$ sudo pwck -r user 'smithj': directory '/home/smithj' does not exist If any home directories referenced in "/etc/passwd" are returned as not defined, this is a finding.

Fix text

Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd": Note: The example will be for the user smithj, who has a home directory of "/home/smithj", a User ID (UID) of "smithj", and a Group Identifier (GID) of "users assigned" in "/etc/passwd". #$ sudo mkdir /home/smithj #$ sudo chown smithj /home/smithj #$ sudo chgrp users /home/smithj #$ sudo chmod 0750 /home/smithj

V-215006 in V2R3

Check text

Verify the assigned home directory of all local interactive users has a mode of "0750" or less permissive. Check the home directory assignment for all non-privileged users with the following command: Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. #$ sudo ls -ld $(awk -F: '($3>=1000)&&($17 !="nobody"~ /nologin/){print $6}' /etc/passwd) drwxr-x--- 2 smithj admin 4096 Jun 5 12:41 smithj If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less permissive, this is a finding.

Fix text

Change the mode of interactive user’s home directories to "0750". To change the mode of a local interactive user’s home directory, use the following command: Note: The example will be for the user "smithj". #$ sudo chmod 0750 /home/smithj

V-215007 in V2R3

Check text

Verify the assigned home directory of all local interactive users is group-owned by that user’s primary Group Identifier (GID). Check the home directory assignment for all non-privileged users on the system with the following command: Note: This may miss local interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information. The returned directory "/home/smithj" is used as an example. #$ sudo ls -ld $(awk -F: '($3>=1000)&&($17 !="nobody"~ /nologin/){print $6}' /etc/passwd) drwxr-x--- 2 smithj admin 4096 Jun 5 12:41 smithj Check the user's primary group with the following command: #$ sudo grep admin /etc/group admin:x:250:smithj,jonesj,jacksons If the user home directory referenced in "/etc/passwd" is not group-owned by that user’s primary GID, this is a finding.

Fix text

Change the group owner of a local interactive user’s home directory to the group found in "/etc/passwd". To change the group owner of a local interactive user’s home directory, use the following command: Note: The example will be for the user "smithj", who has a home directory of "/home/smithj", and has a primary group of users. #$ sudo chgrp users /home/smithj

V-215008 in V2R3