CloudLinux AlmaLinux OS 9 Security Technical Implementation Guide

Version: 1

Updated: 03 Dec 2024

Findings: 445

Findings

V-269102 - AlmaLinux OS 9 must limit the number of concurrent sessions to ten for all accounts and/or account types. (low)
V-269103 - AlmaLinux OS 9 must automatically lock graphical user sessions after 15 minutes of inactivity. (medium)
V-269104 - AlmaLinux OS 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image. (medium)
V-269105 - AlmaLinux OS 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface. (medium)
V-269106 - AlmaLinux OS 9 must initiate a session lock for graphical user interfaces when the screensaver is activated. (medium)
V-269107 - AlmaLinux OS 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface. (medium)
V-269108 - AlmaLinux OS 9 must automatically exit interactive command shell user sessions after 10 minutes of inactivity. (medium)
V-269109 - AlmaLinux OS 9 must be able to directly initiate a session lock for all connection types using smart card when the smart card is removed. (medium)
V-269110 - AlmaLinux OS 9 must prevent a user from overriding the disabling of the graphical user smart card removal action. (medium)
V-269111 - AlmaLinux OS 9 must log SSH connection attempts and failures to the server. (medium)
V-269112 - All AlmaLinux OS 9 remote access methods must be monitored. (medium)
V-269113 - AlmaLinux OS 9 SSH client must be configured to use only encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections. (medium)
V-269114 - AlmaLinux OS 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH client connections. (medium)
V-269115 - AlmaLinux OS 9 SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms. (medium)
V-269116 - AlmaLinux OS 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH server connections. (medium)
V-269117 - AlmaLinux OS 9 SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms. (medium)
V-269118 - AlmaLinux OS 9 must implement DOD-approved systemwide cryptographic policies to protect the confidentiality of SSH server connections. (medium)
V-269119 - AlmaLinux OS 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms. (medium)
V-269120 - AlmaLinux OS 9 must force a frequent session key renegotiation for SSH connections to the server. (medium)
V-269121 - AlmaLinux OS 9 must implement DOD-approved TLS encryption in the GnuTLS package. (high)
V-269122 - AlmaLinux OS 9 IP tunnels must use FIPS 140-3 approved cryptographic algorithms. (medium)
V-269123 - AlmaLinux OS 9 must implement DOD-approved encryption in the OpenSSL package. (medium)
V-269124 - AlmaLinux OS 9 must implement DOD-approved TLS encryption in the OpenSSL package. (medium)
V-269125 - AlmaLinux OS 9 must use the TuxCare FIPS repository. (high)
V-269126 - AlmaLinux OS 9 must use the TuxCare FIPS packages and not the default encryption packages. (high)
V-269127 - AlmaLinux OS 9 must enable FIPS mode. (high)
V-269128 - AlmaLinux OS 9 must automatically expire temporary accounts within 72 hours. (medium)
V-269129 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers. (medium)
V-269130 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group. (medium)
V-269131 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. (medium)
V-269132 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd. (medium)
V-269133 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. (medium)
V-269134 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. (medium)
V-269135 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/ (medium)
V-269136 - AlmaLinux OS 9 must require authentication to access emergency mode. (medium)
V-269137 - AlmaLinux OS 9 must require a boot loader password. (medium)
V-269138 - AlmaLinux OS 9 must require a unique superuser's name upon booting into single-user and maintenance modes. (medium)
V-269139 - AlmaLinux OS 9 must require authentication to access single-user mode. (medium)
V-269140 - The systemd Ctrl-Alt-Delete burst key sequence in AlmaLinux OS 9 must be disabled. (high)
V-269141 - The Ctrl-Alt-Delete key sequence must be disabled on AlmaLinux OS 9. (high)
V-269142 - AlmaLinux OS 9 must have the sudo package installed. (medium)
V-269143 - The AlmaLinux OS 9 debug-shell systemd service must be disabled. (medium)
V-269144 - AlmaLinux OS 9 must enable kernel parameters to enforce discretionary access control on hardlinks. (medium)
V-269145 - AlmaLinux OS 9 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks. (medium)
V-269146 - AlmaLinux OS 9 must audit uses of the "execve" system call. (medium)
V-269147 - AlmaLinux OS 9 must automatically lock an account when three unsuccessful logon attempts occur. (medium)
V-269148 - AlmaLinux OS 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. (medium)
V-269149 - AlmaLinux OS 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period. (medium)
V-269150 - AlmaLinux OS 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file. (medium)
V-269151 - AlmaLinux OS 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file. (medium)
V-269152 - AlmaLinux OS 9 must log username information when unsuccessful logon attempts occur. (medium)
V-269153 - AlmaLinux OS 9 must maintain an account lock until the locked account is manually released by an administrator; and not automatically after a set time. (medium)
V-269154 - AlmaLinux OS 9 must ensure account locks persist across reboots. (medium)
V-269155 - AlmaLinux OS 9 must configure the appropriate SELinux context on the nondefault faillock tally directory. (medium)
V-269156 - AlmaLinux OS 9 must prevent users from disabling the Standard Mandatory DOD Notice and Consent Banner for graphical user interfaces. (medium)
V-269157 - AlmaLinux OS 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon. (medium)
V-269158 - AlmaLinux OS 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a command line user logon. (medium)
V-269159 - AlmaLinux OS 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via an SSH user logon. (medium)
V-269160 - AlmaLinux OS 9 must have the s-nail package installed. (medium)
V-269161 - AlmaLinux OS 9 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication. (medium)
V-269162 - AlmaLinux OS 9 SSH daemon must not allow Kerberos authentication. (medium)
V-269163 - AlmaLinux OS 9 must check the GPG signature of software packages originating from external software repositories before installation. (high)
V-269164 - AlmaLinux OS 9 must ensure cryptographic verification of vendor software packages. (high)
V-269165 - AlmaLinux OS 9 must check the GPG signature of locally installed software packages before installation. (high)
V-269166 - AlmaLinux OS 9 must check the GPG signature of repository metadata before package installation. (high)
V-269167 - AlmaLinux OS 9 must have GPG signature verification enabled for all software repositories. (high)
V-269168 - AlmaLinux OS 9 must prevent the loading of a new kernel for later execution. (medium)
V-269169 - AlmaLinux OS 9 system commands must be group-owned by root or a system account. (medium)
V-269170 - AlmaLinux OS 9 system commands must be owned by root. (medium)
V-269171 - AlmaLinux OS 9 system commands must have mode 755 or less permissive. (medium)
V-269172 - AlmaLinux OS 9 library directories must be group-owned by root or a system account. (medium)
V-269173 - AlmaLinux OS 9 library directories must be owned by root. (medium)
V-269174 - AlmaLinux OS 9 library directories must have mode 755 or less permissive. (medium)
V-269175 - AlmaLinux OS 9 library files must be group-owned by root or a system account. (medium)
V-269176 - AlmaLinux OS 9 library files must be owned by root. (medium)
V-269177 - AlmaLinux OS 9 library files must have mode 755 or less permissive. (medium)
V-269178 - AlmaLinux OS 9 must disable core dumps for all users. (medium)
V-269179 - AlmaLinux OS 9 must disable acquiring, saving, and processing core dumps. (medium)
V-269180 - AlmaLinux OS 9 must disable storing core dumps. (medium)
V-269181 - AlmaLinux OS 9 must disable core dump backtraces. (medium)
V-269182 - AlmaLinux OS 9 must disable the kernel.core_pattern. (medium)
V-269183 - AlmaLinux OS 9 cron configuration files directory must be group-owned by root. (medium)
V-269184 - AlmaLinux OS 9 cron configuration files directory must be owned by root. (medium)
V-269185 - AlmaLinux OS 9 cron configuration directories must have a mode of 0700 or less permissive. (medium)
V-269186 - AlmaLinux OS 9 /etc/crontab file must have mode 0600. (medium)
V-269187 - AlmaLinux OS 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot. (medium)
V-269188 - AlmaLinux OS 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface. (medium)
V-269189 - All AlmaLinux OS 9 local files and directories must have a valid group owner. (medium)
V-269190 - All AlmaLinux OS 9 local files and directories must have a valid owner. (medium)
V-269191 - AlmaLinux OS 9 /etc/group- file must be group owned by root. (medium)
V-269192 - AlmaLinux OS 9 /etc/group- file must be owned by root. (medium)
V-269193 - AlmaLinux OS 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access. (medium)
V-269194 - AlmaLinux OS 9 /etc/group file must be group owned by root. (medium)
V-269195 - AlmaLinux OS 9 /etc/group file must be owned by root. (medium)
V-269196 - AlmaLinux OS 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access. (medium)
V-269197 - The /boot/grub2/grub.cfg file must be group-owned by root. (medium)
V-269198 - The /boot/grub2/grub.cfg file must be owned by root. (medium)
V-269199 - AlmaLinux OS 9 must disable the ability of systemd to spawn an interactive boot process. (medium)
V-269200 - AlmaLinux OS 9 /etc/gshadow- file must be group-owned by root. (medium)
V-269201 - AlmaLinux OS 9 /etc/gshadow- file must be owned by root. (medium)
V-269202 - AlmaLinux OS 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access. (medium)
V-269203 - AlmaLinux OS 9 /etc/gshadow file must be group-owned by root. (medium)
V-269204 - AlmaLinux OS 9 /etc/gshadow file must be owned by root. (medium)
V-269205 - AlmaLinux OS 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access. (medium)
V-269206 - The graphical display manager must not be the default target on AlmaLinux OS 9 unless approved. (medium)
V-269207 - AlmaLinux OS 9 must disable the user list at logon for graphical user interfaces. (medium)
V-269208 - All AlmaLinux OS 9 local interactive user accounts must be assigned a home directory upon creation. (medium)
V-269209 - All AlmaLinux OS 9 local interactive user home directories defined in the /etc/passwd file must exist. (medium)
V-269210 - All AlmaLinux OS 9 local interactive user home directories must be group-owned by the home directory owner's primary group. (medium)
V-269211 - AlmaLinux OS 9 must prevent code from being executed on file systems that contain user home directories. (medium)
V-269212 - A separate file system must be used for user home directories (such as /home or an equivalent). (medium)
V-269213 - All AlmaLinux OS 9 local interactive users must have a home directory assigned in the /etc/passwd file. (medium)
V-269214 - Executable search paths within the initialization files of all local interactive AlmaLinux OS 9 users must only contain paths that resolve to the system default or the users home directory. (medium)
V-269215 - All AlmaLinux OS 9 local interactive user home directories must have mode 0750 or less permissive. (medium)
V-269216 - AlmaLinux OS 9 must not allow unattended or automatic logon via the graphical user interface. (high)
V-269217 - AlmaLinux OS 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt. (medium)
V-269218 - AlmaLinux OS 9 must not allow blank or null passwords. (medium)
V-269219 - AlmaLinux OS 9 must not have accounts configured with blank or null passwords. (medium)
V-269220 - AlmaLinux OS 9 /etc/passwd- file must be group-owned by root. (medium)
V-269221 - AlmaLinux OS 9 /etc/passwd- file must be owned by root. (medium)
V-269222 - AlmaLinux OS 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access. (medium)
V-269223 - AlmaLinux OS 9 /etc/passwd file must be group-owned by root. (medium)
V-269224 - AlmaLinux OS 9 /etc/passwd file must be owned by root. (medium)
V-269225 - AlmaLinux OS 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access. (medium)
V-269226 - AlmaLinux OS 9 /etc/shadow- file must be group-owned by root. (medium)
V-269227 - AlmaLinux OS 9 /etc/shadow- file must be owned by root. (medium)
V-269228 - AlmaLinux OS 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access. (medium)
V-269229 - AlmaLinux OS 9 /etc/shadow file must be group-owned by root. (medium)
V-269230 - AlmaLinux OS 9 /etc/shadow file must be owned by root. (medium)
V-269231 - AlmaLinux OS 9 /etc/shadow file must have mode 0000 to prevent unauthorized access. (medium)
V-269232 - AlmaLinux OS 9 must restrict privilege elevation to authorized personnel. (medium)
V-269233 - AlmaLinux OS 9 must use the invoking user's password for privilege escalation when using "sudo". (medium)
V-269234 - AlmaLinux OS 9 must set the umask value to 077 for all local interactive user accounts. (medium)
V-269235 - AlmaLinux OS 9 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files. (medium)
V-269236 - AlmaLinux OS 9 must define default permissions for PAM users. (medium)
V-269237 - AlmaLinux OS 9 must define default permissions for logon and nonlogon shells. (medium)
V-269238 - AlmaLinux OS 9 must not have unauthorized accounts. (medium)
V-269239 - AlmaLinux OS 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs). (medium)
V-269240 - AlmaLinux OS 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories. (medium)
V-269241 - AlmaLinux OS 9 must be configured so that the file integrity tool verifies extended attributes. (medium)
V-269242 - AlmaLinux OS 9 must prevent the use of dictionary words for passwords. (medium)
V-269243 - AlmaLinux OS 9 must not accept router advertisements on all IPv6 interfaces. (medium)
V-269244 - AlmaLinux OS 9 must ignore Internet Control Message Protocol (ICMP) redirect messages. (medium)
V-269245 - The firewalld service on AlmaLinux OS 9 must be active. (medium)
V-269246 - AlmaLinux OS 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems. (medium)
V-269247 - AlmaLinux OS 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs. (medium)
V-269248 - AlmaLinux OS 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. (medium)
V-269249 - AlmaLinux OS 9 must not enable IP packet forwarding unless the system is a router. (medium)
V-269250 - AlmaLinux OS 9 must not have unauthorized IP tunnels configured. (medium)
V-269251 - AlmaLinux OS 9 must log packets with impossible addresses. (medium)
V-269252 - AlmaLinux OS 9 must be configured to prevent unrestricted mail relaying. (medium)
V-269253 - AlmaLinux OS 9 must have the nss-tools package installed. (medium)
V-269254 - AlmaLinux OS 9 network interfaces must not be in promiscuous mode. (medium)
V-269255 - AlmaLinux OS 9 must use reverse path filtering on all IP interfaces. (medium)
V-269256 - AlmaLinux OS 9 must not send Internet Control Message Protocol (ICMP) redirects. (medium)
V-269257 - There must be no .shosts files on AlmaLinux OS 9. (medium)
V-269258 - There must be no shosts.equiv files on AlmaLinux OS 9. (medium)
V-269259 - AlmaLinux OS 9 must not forward source-routed packets. (medium)
V-269260 - AlmaLinux OS 9 SSH daemon must not allow compression or must only allow compression after successful authentication. (medium)
V-269261 - The AlmaLinux OS 9 SSH server configuration file must be group-owned by root. (medium)
V-269262 - The AlmaLinux OS 9 SSH server configuration file must be owned by root. (medium)
V-269263 - AlmaLinux OS 9 SSH server configuration files must have mode 0600 or less permissive. (medium)
V-269264 - AlmaLinux OS 9 must not allow a noncertificate trusted host SSH logon to the system. (medium)
V-269265 - AlmaLinux OS 9 SSH private host key files must have mode 0640 or less permissive. (medium)
V-269266 - AlmaLinux OS 9 SSH public host key files must have mode 0644 or less permissive. (medium)
V-269267 - AlmaLinux OS 9 SSH daemon must not allow known hosts authentication. (medium)
V-269268 - AlmaLinux OS 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon. (medium)
V-269269 - AlmaLinux OS 9 SSH daemon must not allow rhosts authentication. (medium)
V-269270 - AlmaLinux OS 9 SSH daemon must disable remote X connections for interactive users. (medium)
V-269271 - AlmaLinux OS 9 SSH daemon must prevent remote hosts from connecting to the proxy display. (medium)
V-269272 - If the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon must be configured to operate in secure mode. (medium)
V-269273 - AlmaLinux OS 9 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time (JIT) compiler. (medium)
V-269274 - AlmaLinux OS 9 effective dconf policy must match the policy keyfiles. (medium)
V-269275 - AlmaLinux OS 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification. (medium)
V-269276 - All AlmaLinux OS 9 local initialization files must have mode 0740 or less permissive. (medium)
V-269277 - AlmaLinux OS 9 must have the gnutls-utils package installed. (medium)
V-269278 - The kdump service on AlmaLinux OS 9 must be disabled. (medium)
V-269279 - AlmaLinux OS 9 must disable the ability of a user to restart the system from the login screen. (medium)
V-269280 - AlmaLinux OS 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface. (medium)
V-269281 - AlmaLinux OS 9 must prevent special devices on file systems that are used with removable media. (medium)
V-269282 - AlmaLinux OS 9 must prevent code from being executed on file systems that are used with removable media. (medium)
V-269283 - AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. (medium)
V-269284 - AlmaLinux OS 9 must disable the use of user namespaces. (medium)
V-269285 - AlmaLinux OS 9 must prevent special devices on file systems that are imported via Network File System (NFS). (medium)
V-269286 - AlmaLinux OS 9 must prevent code execution on file systems that are imported via Network File System (NFS). (medium)
V-269287 - AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS). (medium)
V-269288 - AlmaLinux OS 9 must configure a DNS processing mode set be Network Manager. (medium)
V-269289 - AlmaLinux OS 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured. (medium)
V-269290 - AlmaLinux OS 9 must prevent special devices on nonroot local partitions. (medium)
V-269291 - The root account must be the only account having unrestricted access to an AlmaLinux OS 9 system. (medium)
V-269292 - AlmaLinux OS 9 must be configured so that the cryptographic hashes of system files match vendor values. (medium)
V-269293 - AlmaLinux OS 9 must clear the page allocator to prevent use-after-free attacks. (medium)
V-269294 - AlmaLinux OS 9 must display the date and time of the last successful account logon upon logon. (medium)
V-269295 - AlmaLinux OS 9 security patches and updates must be installed and up to date. (medium)
V-269296 - AlmaLinux OS 9 policycoreutils-python-utils package must be installed. (medium)
V-269297 - AlmaLinux OS 9 must enable the hardware random number generator entropy gatherer service. (medium)
V-269298 - AlmaLinux OS 9 must have the rng-tools package installed. (medium)
V-269299 - The SSH daemon must perform strict mode checking of home directory configuration files. (medium)
V-269300 - AlmaLinux OS 9 system accounts must not have an interactive login shell. (medium)
V-269301 - AlmaLinux OS 9 must use a separate file system for /tmp. (medium)
V-269302 - Local AlmaLinux OS 9 initialization files must not execute world-writable programs. (medium)
V-269303 - AlmaLinux OS 9 must use a separate file system for /var/log. (medium)
V-269304 - AlmaLinux OS 9 must use a separate file system for /var. (medium)
V-269305 - AlmaLinux OS 9 must use a separate file system for /var/tmp. (medium)
V-269306 - AlmaLinux OS 9 must disable virtual system calls. (medium)
V-269307 - AlmaLinux OS 9 must use cron logging. (medium)
V-269308 - AlmaLinux OS 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation. (medium)
V-269309 - AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories. (medium)
V-269310 - AlmaLinux OS 9 must prevent device files from being interpreted on file systems that contain user home directories. (medium)
V-269311 - AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory. (medium)
V-269312 - AlmaLinux OS 9 must mount /boot with the nodev option. (medium)
V-269313 - AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory. (medium)
V-269314 - AlmaLinux OS 9 must mount /dev/shm with the nodev option. (medium)
V-269315 - AlmaLinux OS 9 must mount /dev/shm with the noexec option. (medium)
V-269316 - AlmaLinux OS 9 must mount /dev/shm with the nosuid option. (medium)
V-269317 - AlmaLinux OS 9 must mount /tmp with the nodev option. (medium)
V-269318 - AlmaLinux OS 9 must mount /tmp with the noexec option. (medium)
V-269319 - AlmaLinux OS 9 must mount /tmp with the nosuid option. (medium)
V-269320 - AlmaLinux OS 9 must mount /var/log/audit with the nodev option. (medium)
V-269321 - AlmaLinux OS 9 must mount /var/log/audit with the noexec option. (medium)
V-269322 - AlmaLinux OS 9 must mount /var/log/audit with the nosuid option. (medium)
V-269323 - AlmaLinux OS 9 must mount /var/log with the nodev option. (medium)
V-269324 - AlmaLinux OS 9 must mount /var/log with the noexec option. (medium)
V-269325 - AlmaLinux OS 9 must mount /var/log with the nosuid option. (medium)
V-269326 - AlmaLinux OS 9 must mount /var with the nodev option. (medium)
V-269327 - AlmaLinux OS 9 must mount /var/tmp with the nodev option. (medium)
V-269328 - AlmaLinux OS 9 must mount /var/tmp with the noexec option. (medium)
V-269329 - AlmaLinux OS 9 must mount /var/tmp with the nosuid option. (medium)
V-269330 - AlmaLinux OS 9 fapolicy module must be enabled. (medium)
V-269331 - AlmaLinux OS 9 fapolicy module must be installed. (medium)
V-269332 - AlmaLinux OS 9 must disable remote management of the chrony daemon. (medium)
V-269333 - AlmaLinux OS 9 must prevent the chrony daemon from acting as a server. (medium)
V-269334 - AlmaLinux OS 9 must not have the iprutils package installed. (medium)
V-269335 - AlmaLinux OS 9 must not have the quagga package installed. (medium)
V-269336 - AlmaLinux OS 9 must not have the sendmail package installed. (medium)
V-269337 - AlmaLinux OS 9 must not have the telnet-server package installed. (medium)
V-269338 - AlmaLinux OS 9 must not have a Trivial File Transfer Protocol (TFTP) client package installed. (medium)
V-269339 - AlmaLinux OS 9 must not have the cups package installed. (medium)
V-269340 - AlmaLinux OS 9 must not have the gssproxy package installed. (medium)
V-269341 - AlmaLinux OS 9 must disable the Asynchronous Transfer Mode (ATM) kernel module. (medium)
V-269342 - AlmaLinux OS 9 must be configured to disable Bluetooth. (medium)
V-269343 - AlmaLinux OS 9 must disable the Controller Area Network (CAN) kernel module. (medium)
V-269344 - AlmaLinux OS 9 must disable mounting of cramfs. (medium)
V-269345 - AlmaLinux OS 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module. (medium)
V-269346 - AlmaLinux OS 9 must disable mounting of squashfs. (medium)
V-269347 - AlmaLinux OS 9 must disable the Transparent Inter Process Communication (TIPC) kernel module. (medium)
V-269348 - AlmaLinux OS 9 must disable mounting of udf. (medium)
V-269349 - Cameras must be disabled or covered when not in use. (medium)
V-269350 - AlmaLinux OS 9 must not have the nfs-utils package installed. (medium)
V-269351 - AlmaLinux OS 9 must not have the rsh package installed. (medium)
V-269352 - AlmaLinux OS 9 must not have the rsh-server package installed. (medium)
V-269353 - AlmaLinux OS 9 must not have the tuned package installed. (medium)
V-269354 - A graphical display manager must not be installed on AlmaLinux OS 9 unless approved. (medium)
V-269355 - AlmaLinux OS 9 must not have the ypserv package installed. (medium)
V-269356 - AlmaLinux OS 9 must not have the avahi package installed. (medium)
V-269357 - AlmaLinux OS 9 must be configured to disable USB mass storage. (medium)
V-269358 - AlmaLinux OS 9 must have the firewalld package installed. (medium)
V-269359 - AlmaLinux OS 9 must require users to provide authentication for privilege escalation. (medium)
V-269360 - AlmaLinux OS 9 must require users to provide a password for privilege escalation. (medium)
V-269361 - AlmaLinux OS 9 must not be configured to bypass password requirements for privilege escalation. (medium)
V-269362 - AlmaLinux OS 9 must require reauthentication when using the "sudo" command. (medium)
V-269363 - AlmaLinux OS 9 must restrict the use of the "su" command. (medium)
V-269364 - Groups must have unique Group IDs (GIDs). (medium)
V-269365 - Duplicate User IDs (UIDs) must not exist for interactive users. (medium)
V-269366 - All AlmaLinux OS 9 interactive users must have a primary group that exists. (medium)
V-269367 - AlmaLinux OS 9 SSHD must accept public key authentication. (medium)
V-269368 - AlmaLinux OS 9 must have the opensc package installed. (medium)
V-269369 - The pcscd socket on AlmaLinux OS 9 must be active. (medium)
V-269370 - AlmaLinux OS 9 must have the pcsc-lite package installed. (medium)
V-269371 - AlmaLinux OS 9 must implement certificate status checking for multifactor authentication. (medium)
V-269372 - AlmaLinux OS 9 must enable certificate based smart card authentication. (medium)
V-269373 - AlmaLinux OS 9 must have the openssl-pkcs11 package installed. (medium)
V-269374 - AlmaLinux OS 9 SSHD must not allow blank passwords. (medium)
V-269375 - AlmaLinux OS 9 must use the CAC smart card driver. (medium)
V-269376 - AlmaLinux OS 9 must not permit direct logons to the root account using remote access via SSH. (medium)
V-269377 - AlmaLinux OS 9 must disable the graphical user interface automount function unless required. (medium)
V-269378 - AlmaLinux OS 9 must prevent a user from overriding the disabling of the graphical user interface automount function. (medium)
V-269379 - AlmaLinux OS 9 must prevent a user from overriding the disabling of the graphical user interface autorun function. (medium)
V-269380 - AlmaLinux OS 9 must have the USBGuard package installed. (medium)
V-269381 - AlmaLinux OS 9 must have the USBGuard package enabled. (medium)
V-269382 - AlmaLinux OS 9 must block unauthorized peripherals before establishing a connection. (medium)
V-269383 - AlmaLinux OS 9 must not have the autofs package installed. (medium)
V-269384 - AlmaLinux OS 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity. (medium)
V-269385 - AlmaLinux OS 9 must enforce password complexity by requiring that at least one lowercase character be used. (medium)
V-269386 - AlmaLinux OS 9 must ensure the password complexity module is enabled in the password-auth file. (medium)
V-269387 - AlmaLinux OS 9 must ensure the password complexity module in the system-auth file is configured for three retries or less. (medium)
V-269388 - AlmaLinux OS 9 must enforce password complexity rules for the root account. (medium)
V-269389 - AlmaLinux OS 9 must enforce password complexity by requiring that at least one uppercase character be used. (medium)
V-269390 - AlmaLinux OS 9 must enforce password complexity by requiring that at least one special character be used. (medium)
V-269391 - AlmaLinux OS 9 passwords for new users must have a minimum of 15 characters. (medium)
V-269392 - AlmaLinux OS 9 passwords must be created with a minimum of 15 characters. (medium)
V-269393 - AlmaLinux OS 9 must enforce password complexity by requiring that at least one numeric character be used. (medium)
V-269394 - AlmaLinux OS 9 must require the change of at least four character classes when passwords are changed. (medium)
V-269395 - AlmaLinux OS 9 must require the maximum number of repeating characters be limited to three when passwords are changed. (medium)
V-269396 - AlmaLinux OS 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed. (medium)
V-269397 - AlmaLinux OS 9 must require the change of at least eight characters when passwords are changed. (medium)
V-269398 - AlmaLinux OS 9 PAM must be configured to use a sufficient number of password hashing rounds. (high)
V-269399 - AlmaLinux OS 9 must be configured so that libuser is configured to store only encrypted representations of passwords. (high)
V-269400 - AlmaLinux OS 9 must be configured so that the system's shadow file is configured to store only encrypted representations of passwords. (high)
V-269401 - AlmaLinux OS 9 must be configured so that the Pluggable Authentication Module is configured to store only encrypted representations of passwords. (high)
V-269402 - AlmaLinux OS 9 must be configured so that interactive user account passwords are using strong password hashes. (high)
V-269403 - AlmaLinux OS 9 must not have any File Transfer Protocol (FTP) packages installed. (high)
V-269404 - AlmaLinux OS 9 must not have any telnet packages installed. (high)
V-269405 - Passwords for existing users must have a 60-day maximum password lifetime restriction in /etc/shadow. (medium)
V-269406 - Passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs. (medium)
V-269407 - Passwords for existing users must have a 24-hour minimum password lifetime restriction in /etc/shadow. (medium)
V-269408 - Passwords for new users or password changes must have a 24-hour minimum password lifetime restriction in /etc/login.defs. (medium)
V-269409 - AlmaLinux OS 9 must prohibit the use of cached authenticators after one day. (medium)
V-269410 - For PKI-based authentication, AlmaLinux OS 9 must enforce authorized access to the corresponding private key. (medium)
V-269411 - AlmaLinux OS 9 must map the authenticated identity to the user or group account for PKI-based authentication. (medium)
V-269412 - AlmaLinux OS 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. (medium)
V-269413 - AlmaLinux OS 9 must use mechanisms meeting the requirements of applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module. (medium)
V-269414 - AlmaLinux OS 9 must prevent system daemons from using Kerberos for authentication. (medium)
V-269415 - The libreswan package must be installed. (medium)
V-269416 - AlmaLinux OS 9 must have the packages required for encrypting offloaded audit logs installed. (medium)
V-269417 - AlmaLinux OS 9 must have the crypto-policies package installed. (medium)
V-269418 - AlmaLinux OS 9 must implement a systemwide encryption policy. (medium)
V-269419 - AlmaLinux OS 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. (medium)
V-269420 - AlmaLinux OS 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD. (high)
V-269421 - AlmaLinux OS 9 must terminate idle user sessions. (medium)
V-269422 - AlmaLinux OS 9 must disable access to network bpf system call from nonprivileged processes. (medium)
V-269423 - AlmaLinux OS 9 must restrict exposed kernel pointer addresses access. (medium)
V-269424 - AlmaLinux OS 9 must restrict usage of ptrace to descendant processes. (medium)
V-269425 - AlmaLinux OS 9 must restrict access to the kernel message buffer. (medium)
V-269426 - AlmaLinux OS 9 must prevent kernel profiling by nonprivileged users. (medium)
V-269427 - AlmaLinux OS 9 must only allow the use of DOD PKI-established certificate authorities for authentication in the establishment of protected sessions to the operating system. (medium)
V-269428 - AlmaLinux OS 9 systemd-journald service must be enabled. (medium)
V-269429 - AlmaLinux OS 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. (high)
V-269430 - AlmaLinux OS 9 must use a Linux Security Module configured to enforce limits on system services. (medium)
V-269431 - AlmaLinux OS 9 must have the policycoreutils package installed. (medium)
V-269432 - Any AlmaLinux OS 9 world-writable directories must be owned by root, sys, bin, or an application user. (medium)
V-269433 - A sticky bit must be set on all AlmaLinux OS 9 public directories. (medium)
V-269434 - AlmaLinux OS 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented. (medium)
V-269435 - AlmaLinux OS 9 must be configured to use TCP syncookies. (medium)
V-269436 - All AlmaLinux OS 9 networked systems must have the OpenSSH client installed. (high)
V-269437 - All AlmaLinux OS 9 networked systems must implement SSH to protect the confidentiality and integrity of transmitted and received information, including information being prepared for transmission. (medium)
V-269438 - All AlmaLinux OS 9 networked systems must have the OpenSSH server installed. (medium)
V-269439 - AlmaLinux OS 9 must not allow users to override SSH environment variables. (medium)
V-269440 - AlmaLinux OS 9 must implement DOD-approved encryption in the bind package. (medium)
V-269441 - AlmaLinux OS 9 wireless network adapters must be disabled. (medium)
V-269442 - AlmaLinux OS 9 must not show boot up messages. (medium)
V-269443 - AlmaLinux OS 9 /var/log directory must be group-owned by root. (medium)
V-269444 - AlmaLinux OS 9 /var/log/messages file must be group-owned by root. (medium)
V-269445 - AlmaLinux OS 9 /var/log/messages file must be owned by root. (medium)
V-269446 - AlmaLinux OS 9 /var/log/messages file must have mode 0640 or less permissive. (medium)
V-269447 - AlmaLinux OS 9 /var/log directory must be owned by root. (medium)
V-269448 - AlmaLinux OS 9 /var/log directory must have mode 0755 or less permissive. (medium)
V-269449 - AlmaLinux OS 9 must implement nonexecutable data to protect its memory from unauthorized code execution. (medium)
V-269450 - AlmaLinux OS 9 must enable mitigations against processor-based vulnerabilities. (medium)
V-269451 - AlmaLinux OS 9 must clear SLUB/SLAB objects to prevent use-after-free attacks. (medium)
V-269452 - AlmaLinux OS 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. (medium)
V-269453 - AlmaLinux OS 9 must remove all software components after updated versions have been installed. (medium)
V-269454 - AlmaLinux OS 9 must be a supported release. (high)
V-269455 - AlmaLinux OS 9 must enable the SELinux targeted policy. (medium)
V-269456 - AlmaLinux OS 9 must have the Advanced Intrusion Detection Environment (AIDE) package installed. (medium)
V-269457 - AlmaLinux OS 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered. (medium)
V-269458 - AlmaLinux OS 9 audit system must audit local events. (medium)
V-269459 - AlmaLinux OS 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access. (medium)
V-269460 - AlmaLinux OS 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. (medium)
V-269461 - Successful/unsuccessful uses of the init command in AlmaLinux OS 9 must generate an audit record. (medium)
V-269462 - AlmaLinux OS 9 must generate audit records for any use of the "poweroff" command. (medium)
V-269463 - AlmaLinux OS 9 must generate audit records for any use of the "reboot" command. (medium)
V-269464 - AlmaLinux must generate audit records for any use of the "shutdown" command. (medium)
V-269465 - AlmaLinux OS 9 must enable Linux audit logging for the USBGuard daemon. (medium)
V-269466 - AlmaLinux OS 9 must audit all uses of the delete_module, init_module and finit_module system calls. (medium)
V-269467 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog. (medium)
V-269468 - AlmaLinux OS 9 must produce audit records containing information to establish the identity of any individual or process associated with the event. (medium)
V-269469 - The audit package must be installed on AlmaLinux OS 9. (medium)
V-269470 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog. (medium)
V-269471 - AlmaLinux OS 9 must generate audit records for any use of the "mount" command. (medium)
V-269472 - AlmaLinux OS 9 must generate audit records for any use of the "umount" command. (medium)
V-269473 - Successful/unsuccessful uses of the umount2 system call in AlmaLinux OS 9 must generate an audit record. (medium)
V-269474 - AlmaLinux OS 9 must enable auditing of processes that start prior to the audit daemon. (medium)
V-269475 - AlmaLinux OS 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls. (medium)
V-269476 - AlmaLinux OS 9 must generate audit records for any use of the "chacl" command. (medium)
V-269477 - AlmaLinux OS 9 must generate audit records for any use of the "chage" command. (medium)
V-269478 - AlmaLinux OS 9 must generate audit records for any use of the "chcon" command. (medium)
V-269479 - AlmaLinux OS 9 must audit all uses of the chmod, fchmod, and fchmodat system calls. (medium)
V-269480 - AlmaLinux OS 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls. (medium)
V-269481 - AlmaLinux OS 9 must generate audit records for any use of the "chsh" command. (medium)
V-269482 - AlmaLinux OS 9 must generate audit records for any use of the "crontab" command. (medium)
V-269483 - AlmaLinux OS 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls. (medium)
V-269484 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock. (medium)
V-269485 - AlmaLinux OS 9 must generate audit records for any use of the "gpasswd" command. (medium)
V-269486 - AlmaLinux OS 9 must audit all uses of the kmod command. (medium)
V-269487 - AlmaLinux OS 9 must generate audit records for any use of the "newgrp" command. (medium)
V-269488 - AlmaLinux OS 9 must generate audit records for any use of the "passwd" command. (medium)
V-269489 - AlmaLinux OS 9 must generate audit records for any use of the "postdrop" command. (medium)
V-269490 - AlmaLinux OS 9 must generate audit records for any use of the "postqueue" command. (medium)
V-269491 - AlmaLinux OS 9 must generate audit records for any use of the "su" command. (medium)
V-269492 - AlmaLinux OS 9 must generate audit records for any use of the "sudo" command. (medium)
V-269493 - AlmaLinux OS 9 must generate audit records for any use of the "semanage" command. (medium)
V-269494 - AlmaLinux OS 9 must generate audit records for any use of the "setfacl" command. (medium)
V-269495 - AlmaLinux OS 9 must generate audit records for any use of the "setfiles" command. (medium)
V-269496 - AlmaLinux OS 9 must generate audit records for any use of the "setsebool" command. (medium)
V-269497 - AlmaLinux OS 9 must generate audit records for any use of the "ssh-agent" command. (medium)
V-269498 - AlmaLinux OS 9 must generate audit records for any use of the "ssh-keysign" command. (medium)
V-269499 - AlmaLinux OS 9 must generate audit records for any use of the "sudoedit" command. (medium)
V-269500 - AlmaLinux OS 9 must generate audit records for any use of the "pam_timestamp_check" command. (medium)
V-269501 - AlmaLinux OS 9 must generate audit records for any use of the "unix_chkpwd" command. (medium)
V-269502 - AlmaLinux OS 9 must generate audit records for any use of the "unix_update" command. (medium)
V-269503 - AlmaLinux OS 9 must generate audit records for any use of the "userhelper" command. (medium)
V-269504 - AlmaLinux OS 9 must generate audit records for any use of the "usermod" command. (medium)
V-269505 - AlmaLinux OS 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls. (medium)
V-269506 - AlmaLinux OS 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon. (low)
V-269507 - AlmaLinux OS 9 must use a separate file system for the system audit data path. (low)
V-269508 - AlmaLinux OS 9 must allocate audit record storage capacity to store at least one week's worth of audit records. (medium)
V-269509 - AlmaLinux OS 9 audispd-plugins package must be installed. (medium)
V-269510 - AlmaLinux OS 9 must label all offloaded audit logs before sending them to the central log server. (medium)
V-269511 - AlmaLinux OS 9 must take appropriate action when the internal event queue is full. (medium)
V-269512 - AlmaLinux OS 9 must be configured to offload audit records onto a different system from the system being audited via syslog. (medium)
V-269513 - AlmaLinux OS 9 must authenticate the remote logging server for offloading audit logs via rsyslog. (medium)
V-269514 - AlmaLinux OS 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog. (medium)
V-269515 - AlmaLinux OS 9 must encrypt, via the gtls driver, the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog. (medium)
V-269516 - AlmaLinux OS 9 must have the rsyslog package installed. (medium)
V-269517 - AlmaLinux OS 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog. (low)
V-269518 - The rsyslog service on AlmaLinux OS 9 must be active. (medium)
V-269519 - AlmaLinux OS 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity. (medium)
V-269520 - AlmaLinux OS 9 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity. (medium)
V-269521 - AlmaLinux OS 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. (medium)
V-269522 - AlmaLinux OS 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent usage. (medium)
V-269523 - AlmaLinux OS 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event. (medium)
V-269524 - AlmaLinux OS 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure. (medium)
V-269525 - AlmaLinux OS 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. (medium)
V-269526 - AlmaLinux OS 9 audit system must take appropriate action when the audit storage volume is full. (medium)
V-269527 - AlmaLinux OS 9 must take appropriate action when a critical audit processing failure occurs. (medium)
V-269528 - AlmaLinux OS 9 audit system must make full use of the audit storage space. (medium)
V-269529 - AlmaLinux OS 9 audit system must take appropriate action when the audit files have reached maximum size. (medium)
V-269530 - AlmaLinux OS 9 audit system must retain an optimal number of audit records. (medium)
V-269531 - AlmaLinux OS 9 must periodically flush audit records to disk to prevent the loss of audit records. (medium)
V-269532 - The auditd service must be enabled on AlmaLinux OS 9. (medium)
V-269533 - The chronyd service must be enabled. (medium)
V-269534 - AlmaLinux OS 9 must have the chrony package installed. (medium)
V-269535 - AlmaLinux OS 9 must securely compare internal information system clocks at least every 24 hours. (medium)
V-269536 - AlmaLinux OS 9 audit log directory must be owned by root to prevent unauthorized read access. (medium)
V-269537 - AlmaLinux OS 9 audit log directory must have 0700 permissions to prevent unauthorized read access. (medium)
V-269538 - AlmaLinux OS 9 audit logs must be owned by the root group to prevent unauthorized read access. (medium)
V-269539 - AlmaLinux OS 9 audit logs must be owned by root to prevent unauthorized read access. (medium)
V-269540 - AlmaLinux OS 9 audit logs must have 0600 permissions to prevent unauthorized read access. (medium)
V-269541 - AlmaLinux OS 9 audit tools must be group-owned by root. (medium)
V-269542 - AlmaLinux OS 9 audit tools must be owned by root. (medium)
V-269543 - AlmaLinux OS 9 audit tools must have a mode of 0755 or less permissive. (medium)
V-269544 - AlmaLinux OS 9 audit system must protect logon UIDs from unauthorized change. (medium)
V-269545 - AlmaLinux OS 9 must use cryptographic mechanisms to protect the integrity of audit tools. (medium)
V-269546 - AlmaLinux OS 9 audit system must protect auditing rules from unauthorized change. (medium)