What changed in Canonical Ubuntu 18.04 LTS STIG V2R8V2R8 changes

Title

The Ubuntu operating system must have system commands group-owned by root or a system account.

Check text

Verify the system commands contained in the following directories are group-owned by root or a system account: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin Run the check with the following command: $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type f -exec stat -c "%n %G" '{}' 1; If any system commands are returned that are not Set Group ID up on execution (SGID) files and group-owned by a privilegedrequired system account, this is a finding.

Fix text

Configure the system commands to be protected from unauthorized access. Run the following command: $, sudoreplacing find"[FILE]" /binwith /sbinany /usr/binsystem /usr/sbincommand /usr/local/binfile /usr/local/sbinnot ! -group-owned by "root" -typeor fa !required -permsystem /2000account. $ -execsudo chgrp root '{}' 1;[FILE]

V-219208 in V2R8

Check text

Verify the Ubuntu operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed. Check that the "ctrl-alt-del.target" (otherwise also known as reboot.target) is not active with the following command: #$ sudo systemctl status ctrl-alt-del.target rebootctrl-alt-del.target - Reboot Loaded: loadedmasked (/usrdev/lib/systemd/system/reboot.targetnull; disabledbad) Active: inactive (dead) Docs: man:systemd.special(7) If the "ctrl-alt-del.target" is activenot masked, this is a finding.

Fix text

Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following commandcommands: #$ sudo systemctl disable ctrl-alt-del.target $ sudo systemctl mask ctrl-alt-del.target And reload the daemon to take effect : #$ sudo systemctl daemon-reload

V-219212 in V2R8

Check text

Verify that the Ubuntu operating system monitors all remote access methods. Check that remote access methods are being logged by running the following command: #$ grep -E -r '^(auth,authpriv1.1*|daemon1.1*)' /etc/rsyslog.* /etc/rsyslog.d/50-default.conf:auth,authpriv.* /var/log/auth.log /etc/rsyslog.d/50-default.conf:daemon.notice* /var/log/messages If "auth.*", "authpriv.*" or "daemon.*" are not configured to be logged in at least one of the config files, this is a finding.

Fix text

Configure the Ubuntu operating system to monitor all remote access methods by adding the following lines to the "/etc/rsyslog.d/50-default.conf" file: auth.*,authpriv.* /var/log/secure daemon.notice* /var/log/messages In order for the changes to take effect the "rsyslog" service must be restarted with the following command: #$ sudo systemctl restart rsyslog.service

V-219306 in V2R8

Check text

To verify that null passwords cannot be used, run the following command: #$ grep nullok /etc/pam.d/common_passwordcommon-password If this produces any output, it may be possible to log on with accounts with empty passwords. If null passwords can be used, this is a finding.

Fix text

If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating. Remove any instances of the "nullok" option in "/etc/pam.d/common_passwordcommon-password" to prevent logons with empty passwords.

V-251507 in V2R8