What changed in Cloud Linux AlmaLinux OS 9 STIG V1R8V1R8 changes

Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk, and make remote user access management difficult at best. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). SSH provides several logging levels with varying amounts of verbosity. "DEBUG" is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. "INFO" or "VERBOSE" level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.

V-269111 in V1R8

Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk, and make remote user access management difficult at best. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). Monitoring of remote access can be used to spot attacks such as brute-force authentication attempts and denial-of-service (DoS) attacks.

V-269112 in V1R8

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. AlmaLinux OS 9 incorporates systemwide crypto policies by default. Configuration files in /etc/ssh/ have no effect on the ciphers, MACs, or algorithms used by the operating system. The employed ssh client algorithms can be viewed in the /etc/crypto-policies/back-ends/openssh.config file.

V-269113 in V1R8

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g. RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. AlmaLinux OS 9 incorporates systemwide crypto policies by default. The /etc/ssh/ssh_config file has no effect on the ciphers, MACs, or algorithms. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/openssh.config file.

V-269115 in V1R8

Title

The AlmaLinux 9 SSH server must be configured to use only DODDoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

V-269116 in V1R8

Title

AlmaLinux OS 9 must implement DODoW-approved systemwide cryptographic policies to protect the confidentiality of SSH server connections.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

V-269118 in V1R8

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. AlmaLinux OS 9 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms employed on the server. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.

V-269119 in V1R8

Discussion

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., RDP), thereby providing a degree of confidentiality. The encryption strength of a mechanism is selected based on the security categorization of the information. Session key regeneration limits the chances of a session key becoming compromised.

V-269120 in V1R8

Discussion

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., RDP), thereby providing a degree of confidentiality. The encryption strength of a mechanism is selected based on the security categorization of the information. The operating system must use cryptographic modules that have been validated by NIST's FIPS 140-3 program. Using weak or untested cryptography could compromise the confidentiality and integrity of data at rest and in transit. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000478-GPOS-00223, SRG-OS-000396-GPOS-00176, SRG-OS-000125-GPOS-00065

V-269127 in V1R8

Title

AlmaLinux OS 9 must require a boot loader password.ALMA 9 must require authentication upon booting into single-user and maintenance modes.

Check text

Verify thethat bootALMA loader9 superuserrequires a password isfor requiredthe usingGRUB the2 followingbootloader command: $to grepprevent passwordunauthorized /etc/grub2.cfgmodifications to boot parameters. password_pbkdf2 superman ${GRUB2_PASSWORD} VerifyCheck the bootunified loaderconfiguration superuserfile passwordwhere hasthe beenGRUB set2 and the password is encrypted using the following commandstored: $# catsudo grep -iw "GRUB2_PASSWORD" /boot/grub2/user.cfg GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.5766DCE424DCD4F0A2F5AC774C044BE8B904BC[password_hash] F0022B671CD5E522A3568C599F327EBA3F3F5AB30D69A9B9A4FD172B12435BC10BE0A9B40669FB A5C5ECBE8D1B.EAC815AE6F8A3F79F800D2EC7F454933BC3D63282532AAB1C487CA25331DD359F 5BF61166EDB53FB33977E982A9F20327D988DA15CBF7E4238357E65C5AEAF3C If athe "GRUB2_PASSWORD" entry does not exist, is commented out, or if the hash does not setbegin with "grub.pbkdf2.sha512", this is a finding.

V-269137 in V1R8

Title

AlmaLinux OS 9 must prevent users from disabling the Standard Mandatory DODoW Notice and Consent Banner for graphical user interfaces.

Discussion

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." If a login banner is not displayed, it may be difficult to prosecute an attacker. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088

V-269156 in V1R8

Title

AlmaLinux OS 9 must display the Standard Mandatory DODDoW Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

Check text

Note: This requirement assumes the use of the default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 displays a banner before granting access to the operating system via a graphical user logon. First, identify the location of the banner message file with the following command: $ grep banner-message-text /etc/dconf/db/local.d/* /etc/dconf/db/local.d/01-banner-message Determine if the operating system displays a banner at the logon screen with the following command: $ gsettings get org.gnome.login-screen banner-message-enable true Next, check that file contains the correct wording with the following command (substituting the path from above): $ cat /etc/dconf/db/local.d/01-banner-message If the banner is set correctly it will return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner text does not match the Standard Mandatory DODDoW Notice and Consent Banner exactly, or the dconf database does not include the "banner-message-text" setting or if it is not enabled, this is a finding.

Fix text

Configure AlmaLinux OS 9 to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system via a graphical user logon. Create a database to contain the systemwide graphical user logon settings (if it does not already exist) with the following command: $ touch /etc/dconf/db/local.d/01-banner-message Add the following lines to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": [org/gnome/login-screen] banner-message-enable=true banner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.1nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:1n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.1n-At any time, the USG may inspect and seize data stored on this IS.1n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.1n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.1n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.' Run the following command to update the database: $ dconf update

Discussion

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." If a login banner is not displayed, it may be difficult to prosecute an attacker. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088

V-269157 in V1R8

Title

AlmaLinux OS 9 must display the Standard Mandatory DODDoW Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

Check text

Verify AlmaLinux OS 9 displays the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the operating system via a command line user logon. Check that a banner is displayed at the command line login screen with the following command: $ cat /etc/issue If the banner is set correctly it will return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner text does not match the Standard Mandatory DODDoW Notice and Consent Banner exactly, this is a finding.

Fix text

Configure AlmaLinux OS 9 to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system via command line logon by running the command: $ cat &lt&lt EOF | tee /etc/issue You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. EOF

Discussion

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." If a login banner is not displayed, it may be difficult to prosecute an attacker. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088

V-269158 in V1R8

Title

AlmaLinux OS 9 must display the Standard Mandatory DODoW Notice and Consent Banner before granting local or remote access to the system via an SSH user logon.

Check text

Verify AlmaLinux OS 9 displays the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the operating system via a command line user logon. First, check that a banner text is correct with the following command: $ cat /etc/issue.net If the banner is set correctly it will return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Next, check that the OpenSSH server is configured to display the banner using the following command: $ sshd -T | grep banner banner /etc/issue.net If the banner text does not match the Standard Mandatory DODDoW Notice and Consent Banner exactly, or the SSH configuration does not include "Banner /etc/issue.net", this is a finding.

Fix text

Configure AlmaLinux OS 9 to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system via command line logon by running the command: cat &lt&lt EOF | tee /etc/issue.net You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. EOF

Discussion

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." If a login banner is not displayed, it may be difficult to prosecute an attacker. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088

V-269159 in V1R8

Discussion

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are not allowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA).

V-269163 in V1R8

Discussion

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are not allowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA).

V-269164 in V1R8

Discussion

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowednot allowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA).

V-269165 in V1R8

Discussion

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowednot allowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA).

V-269166 in V1R8

Discussion

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowednot allowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA).

V-269167 in V1R8

Discussion

"Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. AlmaLinux OS 9 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). Satisfies: SRG-OS-000480-GPOS-00232, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115

V-269245 in V1R8

Discussion

Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems. It also permits outbound connections that may facilitate exfiltration of DODDoW data. AlmaLinux OS 9 incorporates the "firewalld" daemon, which allows for many different configurations. One of these configurations is zones. Zones can be used to a deny-all, allow-by-exception approach. The default "drop" zone will drop all incoming network packets unless it is explicitly allowed by the configuration file or is related to an outgoing network connection.

V-269246 in V1R8

Check text

Verify that ALMA 9 system accounts mustdo not have an interactive login shell. Run with the following command to list any system account (UID &lt 1000) that has an interactive shell, excluding authorized system utility accounts (root, sync, shutdown, halt): $ $ awk -F: '(($3 > 0 &lt1000& $3 &lt 1000) && $1 !~ /^(halt|sync|shutdown)$/ && $7 !~ /(nologin|false)$/) {print $1 ":" $3 ":" $7}' /etc/passwd root:0:/bin/bash bin:1:/sbin/nologin daemon:2:/sbin/nologin adm:3:/sbin/nologin lp:4:/sbin/nologin sync:5:/bin/sync shutdown:6:/sbin/shutdown halt:7:/sbin/halt mail:8:/sbin/nologin operator:11:/sbin/nologin games:12:/sbin/nologin ftp:14:/sbin/nologin systemd-coredump:999:/sbin/nologin dbus:81:/sbin/nologin polkitd:998:/sbin/nologin tss:59:/sbin/nologin sssd:997:/sbin/nologin unbound:996:/sbin/nologin fapolicyd:995:/sbin/nologin postfix:89:/sbin/nologin sshd:74:/sbin/nologin chrony:994:/sbin/nologin systemd-oom:989:/usr/sbin/nologin IdentifyIf the systemcommand accountsreturns from this listing that do not have a nologin shell. If any system account (other than the root account) has a login shell and it is not documented with the information system security officer (ISSO)output, this is a finding.

Fix text

Configure AlmaLinuxALMA OS 9 so that all noninteractive accounts on the system do not have an interactive shell assigned to them. If the system account needs a shell assigned for mission operations, document the need with the information system security officer (ISSO). Run the following command to disable the interactive shell for a specific noninteractive user account, replacing &ltuser> with the user that has a login shell.: $ sudo usermod --shell /usr/sbin/nologin &ltuser> Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.

V-269300 in V1R8

Check text

Verify that "rsyslog" is configured to log cron events with the following command: Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files. $ grep -s "cron.1*" /etc/rsyslog.conf /etc/rsyslog.d/*.conf /etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none d/var/log/messages /etc/rsyslog.conf:# Log 99-cron stuff /etc/rsyslog-stig.conf:cron.* action(type="omfile" file="/var/log/cron") If the command does not return a responseline demonstrating logging to /var/log/cron, checkperform fora functional cron loggingtest. Inject alla facilitiesmessage into the cron logging facility with the following command: $ greplogger -sp /var/cron.info "STIG-TEST-CRON-LOGGING" Check if it successfully wrote to the dedicated log/messages /etc/rsyslog.conffile /etc/rsyslog.d/*.confwith the following command: $ sudo grep "STIG-TEST-CRON-LOGGING" /etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none /var/log/messagescron Jul 16 11:33:00 RHEL10Sim pdosadmin[33692]: STIG-TEST-CRON-LOGGING If "rsyslog" is not logging messages for the cron facility or all facilities, this is a finding.

Fix text

Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory: cron.* /var/log/cron The rsyslog daemon must be restarted for the changes to take effect: $ sudo systemctl restart rsyslog.service

V-269307 in V1R8

Check text

Note: For systems that use BIOS and for vfat systems, this requirement is not applicable. Verify the /boot/efi directory is mounted with the "nosuid" option with the following command: $ mount | grep '1s/boot/efi1s' /dev/sda1 on /boot/efi type vfat (rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=winnt,errors=remount-ro) If the /boot/efi file system does not have the "nosuid" option set, this is a finding.

V-269311 in V1R8

Discussion

This requirement applies to wireless peripheral technologies (e.g., wireless mice, keyboards, displays, etc.) used with AlmaLinux OS 9 systems. Wireless peripherals (e.g., Wi-Fi/Bluetooth/IR keyboards, mice and pointing devices, and near field communications [NFC]) present a unique challenge by creating an open, unsecured port on a computer. Wireless peripherals must meet DODDoW requirements for wireless data transmission and be approved for use by the authorizing official (AO). Even though some wireless peripherals, such as mice and pointing devices, do not ordinarily carry information that need to be protected, modification of communications with these wireless peripherals may be used to compromise the AlmaLinux OS 9 operating system.

V-269342 in V1R8

Discussion

"Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. AlmaLinux OS 9 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000298-GPOS-00116, SRG-OS-000297-GPOS-00115

V-269358 in V1R8

Check text

Verify AlmaLinux OS 9 requires reauthentication when using the "sudo" command to elevate privileges with the following command: $ grep timestamp_timeout /etc/sudoers /etc/sudoers.d/* /etc/sudoers.d/01_stig:Defaults timestamp_timeout=0 If results are returned from more than one file location, this is a finding. If "timestamp_timeout" is set to a value other than "0" (including negative numbernumbers), is commented out, conflicting results or nois resultsmissing are returnedentirely, this is a finding.

Fix text

Configure AlmaLinux OS 9 to reauthenticate "sudo" commands after the specified timeout: Add the following line to "/etc/sudoers" or a file withinin "/etc/sudoers.d/": Defaults timestamp_timeout=0 Remove any duplicate definitions.

V-269362 in V1R8

Discussion

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: 1) something a user knows (e.g., password/PIN); 2) something a user has (e.g., cryptographic identification device, token); and 3) something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). The DODDoW CAC with DODDoW-approved PKI is an example of multifactor authentication.

V-269367 in V1R8

Discussion

Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DODDoW Commoncommon Accessaccess Cardcard. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). This requires further clarification from NIST.

V-269368 in V1R8

Discussion

Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DODDoW Commoncommon Accessaccess Cardcard. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). This requires further clarification from NIST.

V-269370 in V1R8

Discussion

Using an authentication device, such as a DODDoW Commoncommon Accessaccess Cardcard (CAC) or token that is separate from the information system, ensures that even if the information system is compromised, credentials stored on the authentication device will not be affected. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification (PIV) card and the DODDoW CAC. AlmaLinux OS 9 includes multiple options for configuring certificate status checking, but for this requirement focuses on the System Security Services Daemon (SSSD). By default, SSSD performs Online Certificate Status Protocol (OCSP) checking and certificate verification using a sha256 digest function.

V-269371 in V1R8

Discussion

Using an authentication device, such as a DoW common access card (CAC) or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DODDoW Common Access Card. A privileged account is defined as an information system account with authorizations of a privileged user. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). This requires further clarification from NIST. Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000105-GPOS-00052, SRG-OS-000705-GPOS-00150

V-269372 in V1R8

Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DODDoW has mandated the use of the DoW common access card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems. Satisfies: SRG-OS-000377-GPOS-00162, SRG-OS-000376-GPOS-00161, SRG-OS-000375-GPOS-00160, SRG-OS-000105-GPOS-00052

V-269373 in V1R8

Title

Passwords for existing users must have a 6180-day maximum password lifetime restriction in /etc/shadow.

Check text

Check whether the maximum time period for existing passwords is restricted to 60180 days with the following command: $ awk -F: '$5 &lt= 0 || $5 > 60180 {print $1 " " $5}' /etc/shadow If any results are returned that are not associated with a system account, this is a finding.

Fix text

Configure noncompliant accounts to enforce a 60-day maximum password lifetime restriction using the following command, substituting in the username: $ chage -M 60180 [user]

Discussion

Any password, no matter how complex, can eventually be cracked. Therefore, Passwordspasswords must be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

V-269405 in V1R8

Title

Passwords for new users or password changes must have a 6180-day maximum password lifetime restriction in /etc/login.defs.

Check text

Verify that AlmaLinux OS 9 enforces a 60180-day maximum password lifetime for new user accounts by running the following command: $ grep PASS_MAX_DAYS /etc/login.defs PASS_MAX_DAYS 60180 If the "PASS_MAX_DAYS" parameter value is greater than "60180", is not set, or is commented out, this is a finding.

Fix text

Configure AlmaLinux OS 9 to enforce a 60180-day maximum password lifetime. Modify the "/etc/login.defs" file to set the "PASS_MAX_DAYS" parameter to 60180 or greater: PASS_MAX_DAYS 60180

V-269406 in V1R8

Check text

Verify AlmaLinux OS 9 for PKI-based authentication has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor. If "pam_cert_db_path" is set in "/etc/sssd/sssd.conf" or a "*.conf" file within the "/etc/sssd/conf.d/" directory, substitute that path for the default /etc/sssd/pki/sssd_auth_ca_db.pem used below. Check that the system has a valid DODDoW root CA installed with the following command: $ openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = U.S. Government, OU = DODDoW, OU = PKI, CN = DOD Root CA 3 Validity Not Before: Mar 20 18:46:41 2012 GMT Not After: Dec 30 18:46:41 2029 GMT Subject: C = US, O = U.S. Government, OU = DODDoW, OU = PKI, CN = DOD Root CA 3 Subject Public Key Info: Public Key Algorithm: rsaEncryption If the root CA file is not a DODDoW-issued certificate with a valid date and installed in "/etc/sssd/pki/sssd_auth_ca_db.pem" (or pam_cert_db_path location) this is a finding.

Fix text

Configure AlmaLinux OS 9, for PKI-based authentication, to validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. Obtain a valid copy of the DODDoW root CA file from the PKI CA certificate bundle from cyber.mil and copy the DOD_PKE_CA_chainDoW_PKE_CA_chain.pem into the /etc/sssd/pki/sssd_auth_ca_db.pem file (or pam_cert_db_path).

V-269412 in V1R8

Check text

Note: For cloud hosted systems where "ClientAliveInterval" (V-269419) is configured, this setting is not applicable. Verify that AlmaLinux OS 9 logs out sessions that are idle for 10 minutes with the following command: $ systemd-analyze cat-config systemd/logind.conf | grep StopIdleSessionSec #StopIdleSessionSec=infinity StopIdleSessionSec=600 If "StopIdleSessionSec" is not configured to "600" seconds, this is a finding.

V-269421 in V1R8

Title

AlmaLinux OS 9 must only allow the use of DODDoW PKI-established certificate authorities for authentication in the establishment of protected sessions to the operating system.

Check text

Verify AlmaLinux OS 9 only allows the use of DODDoW PKI-established certificate authorities using the following command: $ trust list pkcs11:id=%7C%42%96%AE%DE%4B%48%3B%FA%92%F8%9E%8C%CF%6D%8B%A9%72%37%95;type=cert type: certificate label: ISRG Root X2 trust: anchor category: authority If any nonapproved CAs are returned, this is a finding.

Fix text

Configure AlmaLinux OS 9 to only allow the use of DODDoW PKI-established certificate authorities. For each untrusted CA, export the certificate to a file and add it to the blocklist: $ trust dump --filter "pkcs11:id=%7C%42%96%AE%DE%4B%48%3B%FA%92%F8%9E%8C%CF%6D%8B%A9%72%37%95;type=cert" > /etc/pki/ca-trust/source/blocklist/ISRGRootX2 $ update-ca-trust Verify that the certificate is in the blocklist: $ trust list --filter=blocklist p11-kit: overriding trust for anchor in blocklist: ISRGRootX2 pkcs11:id=%7C%42%96%AE%DE%4B%48%3B%FA%92%F8%9E%8C%CF%6D%8B%A9%72%37%95;type=cert type: certificate label: ISRG Root X2 trust: distrusted category: authority pkcs11:id=%88%68%BF%E0%8E%35%C4%3B%38%6B%62%F7%28%3B%84%81%C8%0C%D7%4D;type=cert type: certificate label: Explicitly Distrust DigiNotar Root CA trust: distrusted category: authority

Discussion

Untrusted Certificatecertificate Authoritiesauthorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DODDoW systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DODDoW-approved CA, trust of this CA has not been established. The DODDoW will only accept PKI-certificates obtained from a DODDoW-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates.

V-269427 in V1R8

Discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DODDoW or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components.

V-269433 in V1R8

Discussion

This requirement applies to wireless peripheral technologies (e.g., wireless mice, keyboards, displays, etc.) used with AlmaLinux OS 9 systems. Wireless peripherals (e.g., Wi-Fi/Bluetooth/IR keyboards, mice and pointing devices, and near field communications [NFC]) present a unique challenge by creating an open, unsecured port on a computer. Wireless peripherals must meet DODDoW requirements for wireless data transmission and be approved for use by the authorizing official (AO). Even though some wireless peripherals, such as mice and pointing devices, do not ordinarily carry information that need to be protected, modification of communications with these wireless peripherals may be used to compromise the AlmaLinux OS 9 operating system. Satisfies: SRG-OS-000481-GPOS-00481, SRG-OS-000299-GPOS-00117, SRG-OS-000300-GPOS-00118

V-269441 in V1R8

Check text

Verify AlmaLinux OS 9 is securely comparing internal information system clocks at least every 24 hours with an NTP server with the following commands: $ grep maxpoll /etc/chrony.conf server 0.us.pool.ntp.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16 or the line is commented out, this is a finding. Verify the "chrony.conf" file is configured to an authoritative DODDoW time source by running the following command: $ grep -i server /etc/chrony.conf server 0.us.pool.ntp.mil If the parameter "server" is not set or is not set to an authoritative DODDoW time source, this is a finding.

V-269535 in V1R8

Check text

Verify AlmaLinuxALMA OS 9 is set to use a FIPS 140-3-compliant systemwide cryptographic policy. Verify the current systemwide crypto-policy with the following command: $ update-crypto-policies --show FIPS If the systemwide crypto -policy is not set to "FIPS", this is a finding. Note: If subpolicies have been configured, they could be listed in a colon-separated list starting with "FIPS" as follows FIPS:&ltSUBPOLICY-NAME>. This is not a finding. Note: Subpolicies like AD-SUPPORT should be configured according to the latest guidance from the operating system vendor. Verify the current minimum crypto-policy configuration with the following commands: $ sudo grep -E 'rsa_size|hash' /etc/crypto-policies/state/CURRENT.pol hash = SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256 min_rsa_size = 2048 If the "hash" values do not include at least the following FIPS 140-3-compliant algorithms, this is a finding: "SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256", this is a finding. If thereany are algorithms that include "SHA1" or a hash value less than "224", this is a finding. If the "min_rsa_size" is not set to a value of at least "2048", this is a finding. If these commands do not return any output, this is a finding.

Fix text

Configure AlmaLinuxALMA OS 9 to use a FIPS 140-3-compliant systemwide cryptographic policy. CreateSet a subpolicy for enhancements to the base systemwide crypto-policy by creating the file /etc/crypto-policies/policies/modules/STIG.pmod with the following content: # Define ciphers and MACs for OpenSSH and libssh cipher@SSH=AES-256-GCM AES-256-CTR AES-128-GCM AES-128-CTR mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256 Apply the policy enhancements to the FIPS systemwide cryptographic policy level with the following command: $ sudo update-crypto-policies --set FIPS:STIG Setting system policy to FIPS Note: IfSystemwide additionalcrypto-policies subpolicies are beingapplied employed,on theyapplication shouldstartup. beIt addedis recommended to therestart update-crypto-policies command. To make the cryptographicsystem settings effective for alreadythe runningchange servicesof andpolicies applications,to restartfully thetake system: $ sudo rebootplace.

V-283455 in V1R8

Title

AlmaLinux OS 9 must implement DODoW-approved encryption in the bind package.

V-283456 in V1R8

Title

AlmaLinux OS 9 must implement DODoW-approved encryption ciphers to protect the confidentiality of SSH connections.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. AlmaLinux OS 9 incorporates systemwide crypto policies by default. The SSH configuration file has no effect on the ciphers, MACs, or algorithms unless specifically defined in the /etc/sysconfig/sshd file. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/opensshserver.config file.

V-283675 in V1R8

Title

AlmaLinux OS 9 must implement DODoW-approved encryption in the OpenSSL package.

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/openssl.config file.

V-283676 in V1R8