Red Hat Enterprise Linux 9 Security Technical Implementation Guide

The Red Hat Enterprise Linux 9 Security Technical Implementation Guide (V2 R9) has 445 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

445STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R9

ArchivedPublished Wed Jul 01 2026

The graphical display manager must not be the default target on RHEL 9 unless approved.

Red Hat Enterprise Linux 9 Security Technical Implementation Guide

Assessment Title

Rule Text

The graphical display manager must not be the default target on RHEL 9 unless approved.

Description

Discussion Text

Unnecessary service packages must not be installed to decrease the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and must not be used, unless approved and documented.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-257781

Rule

SV-257781r991589_rule

Severity

medium

Rule Version

RHEL-09-211030

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify that RHEL 9 is configured to boot to the command line:

$ systemctl get-default

multi-user.target

If the system default target is not set to "multi-user.target" and the information system security officer (ISSO) lacks a documented requirement for a graphical user interface, this is a finding.

Implementation Procedure

Fix Text

Document the requirement for a graphical user interface with the ISSO or set the default target to multi-user with the following command:

$ sudo systemctl set-default multi-user.target

STIG check 4 of 445 in the Red Hat Enterprise Linux 9 STIG checklist

← Previous · V-257779RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.Next · V-257782 →RHEL 9 must enable the hardware random number generator entropy gatherer service.