Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Version: 2

Updated: 22 Jan 2021

Findings: 268

Findings

V-217846 - The system must use a separate file system for /tmp. (low)
V-217847 - The system must use a separate file system for /var. (low)
V-217848 - The system must use a separate file system for /var/log. (low)
V-217849 - The system must use a separate file system for the system audit data path. (low)
V-217850 - The audit system must alert designated staff members when the audit storage volume approaches capacity. (medium)
V-217851 - The system must use a separate file system for user home directories. (low)
V-217852 - Vendor-provided cryptographic certificates must be installed to verify the integrity of system software. (high)
V-217853 - The Red Hat Network Service (rhnsd) service must not be running, unless using RHN or an RHN Satellite. (low)
V-217854 - System security patches and updates must be installed and up-to-date. (medium)
V-217855 - The system package management tool must cryptographically verify the authenticity of system software packages during installation. (medium)
V-217856 - The system package management tool must cryptographically verify the authenticity of all software packages during installation. (low)
V-217857 - A file integrity tool must be installed. (medium)
V-217858 - The system must use a Linux Security Module at boot time. (medium)
V-217859 - A file integrity baseline must be created. (medium)
V-217860 - There must be no .rhosts or hosts.equiv files on the system. (high)
V-217861 - The system must use a Linux Security Module configured to enforce limits on system services. (medium)
V-217862 - The Red Hat Enterprise Linux operating system must not contain .shosts or shosts.equiv files. (high)
V-217863 - The system must use a Linux Security Module configured to limit the privileges of system services. (low)
V-217864 - All device files must be monitored by the system Linux Security Module. (low)
V-217865 - The system must prevent the root account from logging in from virtual consoles. (medium)
V-217866 - The system must prevent the root account from logging in from serial consoles. (low)
V-217867 - Default operating system accounts, other than root, must be locked. (medium)
V-217868 - The system must not have accounts configured with blank or null passwords. (high)
V-217869 - The /etc/passwd file must not contain password hashes. (medium)
V-217870 - The root account must be the only account having a UID of 0. (medium)
V-217871 - The /etc/shadow file must be owned by root. (medium)
V-217872 - The /etc/shadow file must be group-owned by root. (medium)
V-217873 - The /etc/shadow file must have mode 0000. (medium)
V-217874 - The /etc/gshadow file must be owned by root. (medium)
V-217875 - The /etc/gshadow file must be group-owned by root. (medium)
V-217876 - The /etc/gshadow file must have mode 0000. (medium)
V-217877 - The /etc/passwd file must be owned by root. (medium)
V-217878 - The /etc/passwd file must be group-owned by root. (medium)
V-217879 - The /etc/passwd file must have mode 0644 or less permissive. (medium)
V-217880 - The /etc/group file must be owned by root. (medium)
V-217881 - The /etc/group file must be group-owned by root. (medium)
V-217882 - The /etc/group file must have mode 0644 or less permissive. (medium)
V-217883 - Library files must have mode 0755 or less permissive. (medium)
V-217884 - Library files must be owned by a system account. (medium)
V-217885 - All system command files must have mode 755 or less permissive. (medium)
V-217886 - All system command files must be owned by root. (medium)
V-217887 - The system must require passwords to contain a minimum of 15 characters. (medium)
V-217888 - Users must not be able to change passwords more than once every 24 hours. (medium)
V-217889 - User passwords must be changed at least every 60 days. (medium)
V-217890 - Users must be warned 7 days in advance of password expiration. (low)
V-217891 - System and Application account passwords must be changed at least annually. (medium)
V-217892 - The system must require passwords to contain at least one numeric character. (low)
V-217893 - The system must require passwords to contain at least one uppercase alphabetic character. (low)
V-217894 - The system must require passwords to contain at least one special character. (low)
V-217895 - The system must require passwords to contain at least one lower-case alphabetic character. (low)
V-217896 - The system must require at least eight characters be changed between the old and new passwords during a password change. (low)
V-217897 - The system must disable accounts after three consecutive unsuccessful logon attempts. (medium)
V-217898 - The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (system-auth). (medium)
V-217899 - The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (login.defs). (medium)
V-217900 - The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (libuser.conf). (medium)
V-217901 - The system boot loader configuration file(s) must be owned by root. (medium)
V-217902 - The system boot loader configuration file(s) must be group-owned by root. (medium)
V-217903 - The system boot loader configuration file(s) must have mode 0600 or less permissive. (medium)
V-217904 - The system boot loader must require authentication. (medium)
V-217905 - The system must require authentication upon booting into single-user and maintenance modes. (medium)
V-217906 - The system must not permit interactive boot. (medium)
V-217907 - The system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 15 minutes of inactivity from the user at a command prompt, except to fulfill documented and validated mission requirements. (low)
V-217908 - The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts. (medium)
V-217909 - The system must implement virtual address space randomization. (medium)
V-217910 - The system must limit the ability of processes to have simultaneous write and execute access to memory. (medium)
V-217911 - The system must not send ICMPv4 redirects by default. (medium)
V-217912 - The system must not send ICMPv4 redirects from any interface. (medium)
V-217913 - IP forwarding for IPv4 must not be enabled, unless the system is a router. (medium)
V-217914 - The system must not accept IPv4 source-routed packets on any interface. (medium)
V-217915 - The system must not accept ICMPv4 redirect packets on any interface. (medium)
V-217916 - The system must not accept ICMPv4 secure redirect packets on any interface. (medium)
V-217917 - The system must log Martian packets. (low)
V-217918 - The system must not accept IPv4 source-routed packets by default. (medium)
V-217919 - The system must not accept ICMPv4 secure redirect packets by default. (medium)
V-217920 - The system must ignore ICMPv4 redirect messages by default. (low)
V-217921 - The system must not respond to ICMPv4 sent to a broadcast address. (low)
V-217922 - The system must ignore ICMPv4 bogus error responses. (low)
V-217923 - The system must be configured to use TCP syncookies when experiencing a TCP SYN flood. (medium)
V-217924 - The system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces. (medium)
V-217925 - The system must use a reverse-path filter for IPv4 network traffic when possible by default. (medium)
V-217926 - The system must ignore ICMPv6 redirects by default. (medium)
V-217927 - The system must employ a local IPv6 firewall. (medium)
V-217928 - The operating system must connect to external networks or information systems only through managed IPv6 interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture. (medium)
V-217929 - The operating system must prevent public IPv6 access into an organizations internal networks, except as appropriately mediated by managed interfaces employing boundary protection devices. (medium)
V-217930 - The system must employ a local IPv4 firewall. (medium)
V-217931 - The operating system must connect to external networks or information systems only through managed IPv4 interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture. (medium)
V-217932 - The operating system must prevent public IPv4 access into an organizations internal networks, except as appropriately mediated by managed interfaces employing boundary protection devices. (medium)
V-217933 - The systems local IPv4 firewall must implement a deny-all, allow-by-exception policy for inbound packets. (medium)
V-217934 - The Datagram Congestion Control Protocol (DCCP) must be disabled unless required. (medium)
V-217935 - The Stream Control Transmission Protocol (SCTP) must be disabled unless required. (medium)
V-217936 - The Reliable Datagram Sockets (RDS) protocol must be disabled unless required. (low)
V-217937 - The Transparent Inter-Process Communication (TIPC) protocol must be disabled unless required. (medium)
V-217938 - All rsyslog-generated log files must be owned by root. (medium)
V-217939 - All rsyslog-generated log files must be group-owned by root. (medium)
V-217940 - All rsyslog-generated log files must have mode 0600 or less permissive. (medium)
V-217941 - The operating system must back up audit records on an organization defined frequency onto a different system or media than the system being audited. (medium)
V-217942 - The operating system must support the requirement to centrally manage the content of audit records generated by organization defined information system components. (medium)
V-217943 - System logs must be rotated daily. (low)
V-217944 - The operating system must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event. (medium)
V-217945 - The operating system must employ automated mechanisms to facilitate the monitoring and control of remote access methods. (medium)
V-217946 - The operating system must produce audit records containing sufficient information to establish what type of events occurred. (medium)
V-217947 - The system must retain enough rotated audit logs to cover the required log retention period. (medium)
V-217948 - The system must set a maximum audit log file size. (medium)
V-217949 - The system must rotate audit log files that reach the maximum file size. (medium)
V-217950 - The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low. (medium)
V-217951 - The audit system must be configured to audit all attempts to alter system time through adjtimex. (low)
V-217952 - The audit system must be configured to audit all attempts to alter system time through settimeofday. (low)
V-217953 - The audit system must be configured to audit all attempts to alter system time through stime. (low)
V-217954 - The audit system must be configured to audit all attempts to alter system time through clock_settime. (low)
V-217955 - The audit system must be configured to audit all attempts to alter system time through /etc/localtime. (low)
V-217956 - The operating system must automatically audit account creation. (low)
V-217957 - The operating system must automatically audit account modification. (low)
V-217958 - The operating system must automatically audit account disabling actions. (low)
V-217959 - The operating system must automatically audit account termination. (low)
V-217960 - The audit system must be configured to audit modifications to the systems network configuration. (low)
V-217961 - The audit system must be configured to audit modifications to the systems Mandatory Access Control (MAC) configuration (SELinux). (low)
V-217962 - The audit system must be configured to audit all discretionary access control permission modifications using chmod. (low)
V-217963 - The audit system must be configured to audit all discretionary access control permission modifications using chown. (low)
V-217964 - The audit system must be configured to audit all discretionary access control permission modifications using fchmod. (low)
V-217965 - The audit system must be configured to audit all discretionary access control permission modifications using fchmodat. (low)
V-217966 - The audit system must be configured to audit all discretionary access control permission modifications using fchown. (low)
V-217967 - The audit system must be configured to audit all discretionary access control permission modifications using fchownat. (low)
V-217968 - The audit system must be configured to audit all discretionary access control permission modifications using fremovexattr. (low)
V-217969 - The audit system must be configured to audit all discretionary access control permission modifications using fsetxattr. (low)
V-217970 - The audit system must be configured to audit all discretionary access control permission modifications using lchown. (low)
V-217971 - The audit system must be configured to audit all discretionary access control permission modifications using lremovexattr. (low)
V-217972 - The audit system must be configured to audit all discretionary access control permission modifications using lsetxattr. (low)
V-217973 - The audit system must be configured to audit all discretionary access control permission modifications using removexattr. (low)
V-217974 - The audit system must be configured to audit all discretionary access control permission modifications using setxattr. (low)
V-217975 - The audit system must be configured to audit failed attempts to access files and programs. (low)
V-217976 - The audit system must be configured to audit all use of setuid and setgid programs. (low)
V-217977 - The audit system must be configured to audit successful file system mounts. (low)
V-217978 - The audit system must be configured to audit user deletions of files and programs. (low)
V-217979 - The audit system must be configured to audit changes to the /etc/sudoers file. (low)
V-217980 - The audit system must be configured to audit the loading and unloading of dynamic kernel modules. (medium)
V-217981 - The xinetd service must be disabled if no network services utilizing it are enabled. (medium)
V-217982 - The xinetd service must be uninstalled if no network services utilizing it are enabled. (low)
V-217983 - The telnet-server package must not be installed. (high)
V-217984 - The telnet daemon must not be running. (high)
V-217985 - The rsh-server package must not be installed. (high)
V-217986 - The rshd service must not be running. (high)
V-217987 - The rexecd service must not be running. (high)
V-217988 - The rlogind service must not be running. (high)
V-217989 - The ypserv package must not be installed. (medium)
V-217990 - The ypbind service must not be running. (medium)
V-217991 - The tftp-server package must not be installed unless required. (medium)
V-217992 - The TFTP service must not be running. (medium)
V-217993 - The cron service must be running. (medium)
V-217994 - The SSH daemon must be configured to use only the SSHv2 protocol. (high)
V-217995 - The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms. (medium)
V-217996 - The SSH daemon must set a timeout interval on idle sessions. (low)
V-217997 - The SSH daemon must set a timeout count on idle sessions. (low)
V-217998 - The SSH daemon must ignore .rhosts files. (medium)
V-217999 - The SSH daemon must not allow host-based authentication. (medium)
V-218000 - The system must not permit root logins using remote access programs such as ssh. (medium)
V-218001 - The SSH daemon must not allow authentication using an empty password. (high)
V-218002 - The SSH daemon must be configured with the Department of Defense (DoD) login banner. (medium)
V-218003 - The SSH daemon must not permit user environment settings. (low)
V-218004 - The RHEL 6 operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections. (medium)
V-218006 - The avahi service must be disabled. (low)
V-218007 - The system clock must be synchronized continuously, or at least daily. (medium)
V-218008 - The system clock must be synchronized to an authoritative DoD time source. (medium)
V-218009 - Mail relaying must be restricted. (medium)
V-218010 - The openldap-servers package must not be installed unless required. (low)
V-218011 - The graphical desktop environment must set the idle timeout to no more than 15 minutes. (medium)
V-218012 - The graphical desktop environment must automatically lock after 15 minutes of inactivity and the system must require user reauthentication to unlock the environment. (medium)
V-218013 - The graphical desktop environment must have automatic lock enabled. (medium)
V-218014 - The system must display a publicly-viewable pattern during a graphical desktop environment session lock. (low)
V-218015 - The Automatic Bug Reporting Tool (abrtd) service must not be running. (low)
V-218016 - The atd service must be disabled. (low)
V-218017 - The ntpdate service must not be running. (low)
V-218018 - The oddjobd service must not be running. (low)
V-218019 - The qpidd service must not be running. (low)
V-218020 - The rdisc service must not be running. (low)
V-218021 - Remote file systems must be mounted with the nodev option. (medium)
V-218022 - Remote file systems must be mounted with the nosuid option. (medium)
V-218023 - The noexec option must be added to removable media partitions. (low)
V-218024 - The system must use SMB client signing for connecting to samba servers using smbclient. (low)
V-218025 - The system must use SMB client signing for connecting to samba servers using mount.cifs. (low)
V-218026 - The system must prohibit the reuse of passwords within five iterations. (medium)
V-218027 - The operating system must employ cryptographic mechanisms to protect information in storage. (low)
V-218028 - The operating system must protect the confidentiality and integrity of data at rest. (low)
V-218029 - The operating system must employ cryptographic mechanisms to prevent unauthorized disclosure of data at rest unless otherwise protected by alternative physical measures. (low)
V-218030 - The system package management tool must verify permissions on all files and directories associated with the audit package. (medium)
V-218031 - The system package management tool must verify ownership on all files and directories associated with the audit package. (medium)
V-218032 - The system package management tool must verify group-ownership on all files and directories associated with the audit package. (medium)
V-218033 - The system package management tool must verify contents of all files associated with the audit package. (medium)
V-218034 - There must be no world-writable files on the system. (medium)
V-218035 - The system must have a host-based intrusion detection tool installed. (medium)
V-218036 - The x86 Ctrl-Alt-Delete key sequence must be disabled. (high)
V-218037 - The postfix service must be enabled for mail delivery. (low)
V-218038 - The sendmail package must be removed. (medium)
V-218039 - The netconsole service must be disabled unless required. (low)
V-218040 - X Windows must not be enabled unless required. (medium)
V-218041 - The xorg-x11-server-common (X Windows) package must not be installed, unless required. (low)
V-218042 - The DHCP client must be disabled if not needed. (medium)
V-218043 - All GIDs referenced in /etc/passwd must be defined in /etc/group (low)
V-218044 - All accounts on the system must have unique user or account names (low)
V-218045 - Temporary accounts must be provisioned with an expiration date. (low)
V-218046 - Emergency accounts must be provisioned with an expiration date. (low)
V-218047 - The system must require passwords to contain no more than three consecutive repeating characters. (low)
V-218048 - A file integrity tool must be used at least weekly to check for unauthorized file changes, particularly the addition of unauthorized system libraries or binaries, or for unauthorized modification to authorized system libraries or binaries. (medium)
V-218049 - The operating system must employ automated mechanisms, per organization defined frequency, to detect the addition of unauthorized components/devices into the operating system. (medium)
V-218050 - The operating system must employ automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization defined frequency. (medium)
V-218051 - The operating system must provide a near real-time alert when any of the organization defined list of compromise or potential compromise indicators occurs. (medium)
V-218052 - The operating system must detect unauthorized changes to software and information. (medium)
V-218053 - The operating system must ensure unauthorized, security-relevant configuration changes detected are tracked. (medium)
V-218054 - Process core dumps must be disabled unless needed. (low)
V-218055 - The NFS server must not have the insecure file locking option enabled. (high)
V-218056 - The audit system must provide a warning when allocated audit record storage volume reaches a documented percentage of maximum audit record storage capacity. (medium)
V-218057 - The audit system must identify staff members to receive notifications of audit log storage volume capacity issues. (medium)
V-218058 - The Bluetooth kernel module must be disabled. (medium)
V-218059 - The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements. (low)
V-218060 - The systems local firewall must implement a deny-all, allow-by-exception policy for forwarded packets. (medium)
V-218061 - The system must provide VPN connectivity for communications over untrusted networks. (low)
V-218062 - A login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts. (medium)
V-218063 - The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts. (medium)
V-218064 - The Bluetooth service must be disabled. (medium)
V-218065 - Accounts must be locked upon 35 days of inactivity. (low)
V-218066 - The operating system must manage information system identifiers for users and devices by disabling the user identifier after an organization defined time period of inactivity. (low)
V-218067 - The sticky bit must be set on all public directories. (low)
V-218068 - All public directories must be owned by a system account. (low)
V-218069 - The TFTP daemon must operate in secure mode which provides access only to a single directory on the host file system. (high)
V-218070 - The FTP daemon must be configured for logging or verbose mode. (low)
V-218071 - The snmpd service must use only SNMP protocol version 3 or newer. (medium)
V-218072 - The snmpd service must not use a default password. (high)
V-218073 - The system default umask for the bash shell must be 077. (low)
V-218074 - The system default umask for the csh shell must be 077. (low)
V-218075 - The system default umask in /etc/profile must be 077. (low)
V-218076 - The system default umask in /etc/login.defs must be 077. (low)
V-218077 - The system default umask for daemons must be 027 or 022. (low)
V-218078 - There must be no .netrc files on the system. (medium)
V-218079 - The FTPS/FTP service on the system must be configured with the Department of Defense (DoD) login banner. (medium)
V-218080 - The system must be configured to require the use of a CAC, PIV compliant hardware token, or Alternate Logon Token (ALT) for authentication. (medium)
V-218081 - The system must require administrator action to unlock an account locked by excessive failed login attempts. (medium)
V-218082 - The system must disable accounts after excessive login failures within a 15-minute interval. (medium)
V-218083 - The operating system, upon successful logon/access, must display to the user the number of unsuccessful logon/access attempts since the last successful logon/access. (medium)
V-218084 - Audit log files must have mode 0640 or less permissive. (medium)
V-218085 - Audit log files must be owned by root. (medium)
V-218086 - Audit log directories must have mode 0755 or less permissive. (medium)
V-218087 - The operating system must enforce requirements for the connection of mobile devices to operating systems. (medium)
V-218088 - The operating system must conduct backups of user-level information contained in the operating system per organization defined frequency to conduct backups consistent with recovery time and recovery point objectives. (medium)
V-218089 - The operating system must conduct backups of system-level information contained in the information system per organization defined frequency to conduct backups that are consistent with recovery time and recovery point objectives. (medium)
V-218090 - The operating system, upon successful logon, must display to the user the date and time of the last logon or access via ssh. (medium)
V-218091 - The system must allow locking of graphical desktop sessions. (low)
V-218092 - The system must forward audit records to the syslog service. (low)
V-218093 - The audit system must take appropriate action when the audit storage volume is full. (medium)
V-218094 - The audit system must take appropriate action when there are disk errors on the audit storage volume. (medium)
V-218095 - The NFS server must not have the all_squash option enabled. (low)
V-218096 - The system package management tool must verify ownership on all files and directories associated with packages. (low)
V-218097 - The system package management tool must verify group-ownership on all files and directories associated with packages. (low)
V-218098 - The system package management tool must verify permissions on all files and directories associated with packages. (low)
V-218099 - The system package management tool must verify contents of all files associated with packages. (low)
V-218100 - The mail system must forward all mail for root to one or more system administrators. (medium)
V-218101 - Audit log files must be group-owned by root. (medium)
V-218102 - The systems local IPv6 firewall must implement a deny-all, allow-by-exception policy for inbound packets. (medium)
V-218103 - Auditing must be enabled at boot by setting a kernel parameter. (low)
V-218104 - Automated file system mounting tools must not be enabled unless needed. (low)
V-218105 - The login user list must be disabled. (medium)
V-218106 - The noexec option must be added to the /tmp partition. (medium)
V-218107 - The sudo command must require authentication. (medium)
V-218108 - The Red Hat Enterprise Linux operating system must mount /dev/shm with the nodev option. (low)
V-218109 - The Red Hat Enterprise Linux operating system must mount /dev/shm with the nosuid option. (low)
V-218110 - The Red Hat Enterprise Linux operating system must mount /dev/shm with the noexec option. (low)
V-218111 - The Red Hat Enterprise Linux operating system must have an anti-virus solution installed. (medium)
V-218112 - The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. (high)
V-224669 - The Red Hat Enterprise Linux operating system must be a vendor-supported release. (high)
V-224674 - Wireless network adapters must be disabled. (medium)