Tags

Following is a list of relevant tags:

10.3 Disable Autorun and Autoplay for Removable Media

• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use

10.5 Enable Anti-Exploitation Features

• 1.5.1 Ensure address space layout randomization is enabled

3.10 Encrypt Sensitive Data in Transit

• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.6 Ensure sshd Ciphers are configured

3.11 Encrypt Sensitive Data at Rest

• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords

3.14 Log Sensitive Data Access

• 6.3.1 Ensure AIDE is installed

3.3 Configure Data Access Control Lists

• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.2.7 Ensure access to the su command is restricted
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.4 Ensure shadow group is empty
• 7.2.9 Ensure local interactive user home directories are configured

4.1 Establish and Maintain a Secure Configuration Process

• 5.4.1.3 Ensure password expiration warning days is configured
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool

4.3 Configure Automatic Session Locking on Enterprise Assets

• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 5.4.3.2 Ensure default user shell timeout is configured

4.4 Implement and Manage a Firewall on Servers

• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports

4.5 Implement and Manage a Firewall on End-User Devices

• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports

4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.5.2 Ensure ptrace_scope is restricted
• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.10 Ensure XDCMP is not enabled
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client

5.2 Use Unique Passwords

• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 7.2.2 Ensure /etc/shadow password fields are not empty

5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts

• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly

6.2 Establish an Access Revoking Process

• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account

7.3 Perform Automated Operating System Patch Management

• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed

7.4 Perform Automated Application Patch Management

• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed

8.2 Collect Audit Logs

• 5.1.14 Ensure sshd LogLevel is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected

8.3 Ensure Adequate Audit Log Storage

• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.3.8 Ensure logrotate is configured
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space

8.4 Standardize Time Synchronization

• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running

8.5 Collect Detailed Audit Logs

• 3.3.9 Ensure suspicious packets are logged
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.2.3 Ensure sudo log file exists
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.3.2 Ensure filesystem integrity is regularly checked

8.9 Centralize Audit Logs

• 6.1.3.3 Ensure journald is configured to send logs to rsyslog

Access Control

• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.5 Ensure sshd banner is configured
• 5.1.6 Ensure sshd Ciphers are configured
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.3.1.1 Ensure latest version of pam is installed
• 5.3.1.2 Ensure libpam-modules is installed
• 5.3.1.3 Ensure libpam-pwquality is installed
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.1 Ensure nologin is not listed in /etc/shells
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured

Automated

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.5.1 Ensure address space layout randomization is enabled
• 1.5.2 Ensure ptrace_scope is restricted
• 1.5.3 Ensure core dumps are restricted
• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.10 Ensure XDCMP is not enabled
• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.1 Ensure cron daemon is enabled and active
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 3.3.9 Ensure suspicious packets are logged
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.5 Ensure sshd banner is configured
• 5.1.6 Ensure sshd Ciphers are configured
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.3.1.1 Ensure latest version of pam is installed
• 5.3.1.2 Ensure libpam-modules is installed
• 5.3.1.3 Ensure libpam-pwquality is installed
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.1 Ensure nologin is not listed in /etc/shells
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.4 Ensure only one logging system is in use
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.1 Ensure AIDE is installed
• 6.3.2 Ensure filesystem integrity is regularly checked
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist
• 7.2.9 Ensure local interactive user home directories are configured

Confgure PAM Arguments

• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok

Configure /dev/shm

• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition

Configure /home

• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition

Configure /tmp

• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /tmp is a separate partition

Configure /var

• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition

Configure /var/log

• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition

Configure /var/log/audit

• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition

Configure /var/tmp

• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition

Configure Additional Process Hardening

• 1.5.1 Ensure address space layout randomization is enabled
• 1.5.2 Ensure ptrace_scope is restricted
• 1.5.3 Ensure core dumps are restricted

Configure AppArmor

• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing

Configure Bootloader

• 1.4.1 Ensure bootloader password is set

Configure Client Services

• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed

Configure Command Line Warning Banners

• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured

Configure Data Retention

• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space

Configure Filesystem Kernel Modules

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available

Configure GNOME Display Manager

• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.10 Ensure XDCMP is not enabled
• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled

Configure IPv4 iptables

• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports

Configure IPv6 ip6tables

• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports

Configure Integrity Checking

• 6.3.1 Ensure AIDE is installed
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool

Configure Logfiles

• 6.1.4.1 Ensure access to all logfiles has been configured

Configure Network Devices

• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use

Configure Network Kernel Modules

• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available

Configure Network Kernel Parameters

• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 3.3.9 Ensure suspicious packets are logged

Configure PAM Arguments

• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account

Configure PAM software packages

• 5.3.1.1 Ensure latest version of pam is installed
• 5.3.1.2 Ensure libpam-modules is installed
• 5.3.1.3 Ensure libpam-pwquality is installed

Configure SSH Server

• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.5 Ensure sshd banner is configured
• 5.1.6 Ensure sshd Ciphers are configured
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled

Configure Server Services

• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use

Configure Shadow Password Suite Parameters

• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past

Configure System Accounting (auditd)

• 6.2.4.10 Ensure audit tools group owner is configured

Configure Time Synchronization

• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running

Configure UncomplicatedFirewall

• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy

Configure a single firewall utility

• 4.1.1 Ensure a single firewall configuration utility is in use

Configure at

• 2.4.2.1 Ensure at is restricted to authorized users

Configure auditd Service

• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient

Configure auditd file access

• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured

Configure auditd rules

• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected

Configure chrony

• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running

Configure cron

• 2.4.1.1 Ensure cron daemon is enabled and active
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users

Configure filesystem partitions

• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition

Configure iptables

• 4.4.3.2 Ensure ip6tables loopback traffic is configured

Configure iptables software

• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables

Configure journald

• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured

Configure nftables

• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled

Configure package repositories

• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured

Configure package updates

• 1.2.2.1 Ensure updates, patches, and additional security software are installed

Configure pam-auth-update profiles

• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled

Configure pam_faillock module

• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account

Configure pam_pwhistory module

• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok

Configure pam_pwquality module

• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user

Configure pam_unix module

• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok

Configure privilege escalation

• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted

Configure root and system accounts and environment

• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked

Configure rsyslog

• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured

Configure systemd-journald service

• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.1.4 Ensure only one logging system is in use

Configure systemd-journald-remote

• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use

Configure systemd-timesyncd

• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running

Configure user default environment

• 5.4.3.1 Ensure nologin is not listed in /etc/shells
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured

Ensure time synchronization is in use

• 2.3.1.1 Ensure a single time synchronization daemon is in use

Filesystem

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition

Filesystem Integrity Checking

• 6.3.2 Ensure filesystem integrity is regularly checked

Firewall Configuration

• 4.3.5 Ensure nftables base chains exist
• 4.4.3.2 Ensure ip6tables loopback traffic is configured

Host Based Firewall

• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports

IG1

• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.9 Ensure local interactive user home directories are configured

IG2

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.5.1 Ensure address space layout randomization is enabled
• 1.5.2 Ensure ptrace_scope is restricted
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.10 Ensure XDCMP is not enabled
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 3.3.9 Ensure suspicious packets are logged
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.6 Ensure sshd Ciphers are configured
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.2 Ensure filesystem integrity is regularly checked
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.9 Ensure local interactive user home directories are configured

IG3

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.5.1 Ensure address space layout randomization is enabled
• 1.5.2 Ensure ptrace_scope is restricted
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.10 Ensure XDCMP is not enabled
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 3.3.9 Ensure suspicious packets are logged
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.6 Ensure sshd Ciphers are configured
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.1 Ensure AIDE is installed
• 6.3.2 Ensure filesystem integrity is regularly checked
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.9 Ensure local interactive user home directories are configured

Initial Setup

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.5.1 Ensure address space layout randomization is enabled
• 1.5.2 Ensure ptrace_scope is restricted
• 1.5.3 Ensure core dumps are restricted
• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.10 Ensure XDCMP is not enabled
• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 6.3.2 Ensure filesystem integrity is regularly checked

Job Schedulers

• 2.4.1.1 Ensure cron daemon is enabled and active

Job Shedulers

• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users

Level 1

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.5.1 Ensure address space layout randomization is enabled
• 1.5.2 Ensure ptrace_scope is restricted
• 1.5.3 Ensure core dumps are restricted
• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 1.7.10 Ensure XDCMP is not enabled
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.1 Ensure cron daemon is enabled and active
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 3.3.9 Ensure suspicious packets are logged
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.5 Ensure sshd banner is configured
• 5.1.6 Ensure sshd Ciphers are configured
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.3.1.1 Ensure latest version of pam is installed
• 5.3.1.2 Ensure libpam-modules is installed
• 5.3.1.3 Ensure libpam-pwquality is installed
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.1.4 Ensure only one logging system is in use
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.3.1 Ensure AIDE is installed
• 6.3.2 Ensure filesystem integrity is regularly checked
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist
• 7.2.9 Ensure local interactive user home directories are configured

Level 2

• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.2 Ensure GDM login banner is configured
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.3.1 Ensure nologin is not listed in /etc/shells
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool

Local User and Group Settings

• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist
• 7.2.9 Ensure local interactive user home directories are configured

Logging and Auditing

• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.1.4 Ensure only one logging system is in use
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.1 Ensure AIDE is installed
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool

M1001

• 1.7.5 Ensure GDM screen locks cannot be overridden

M1012

• 1.7.4 Ensure GDM screen locks when the user is idle

M1018

• 2.4.1.1 Ensure cron daemon is enabled and active
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 4.2.3 Ensure ufw service is enabled
• 5.1.4 Ensure SSH access is limited
• 6.2.1.1 Ensure auditd packages are installed

M1022

• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.4.2 Ensure access to bootloader config is configured
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.4.2.4 Ensure root account access is controlled
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.8 Ensure logrotate is configured
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.1 Ensure AIDE is installed
• 6.3.2 Ensure filesystem integrity is regularly checked
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.4 Ensure shadow group is empty
• 7.2.9 Ensure local interactive user home directories are configured

M1026

• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.2 Ensure default user shell timeout is configured
• 6.2.3.6 Ensure use of privileged commands are collected

M1027

• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist

M1028

• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 3.1.2 Ensure wireless interfaces are disabled
• 5.2.2 Ensure sudo commands use pty
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.13 Ensure SUID and SGID files are reviewed

M1029

• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client

M1030

• 3.3.1 Ensure IP forwarding is disabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled

M1031

• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports

M1033

• 1.7.1 Ensure GNOME Display Manager is removed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables

M1034

• 1.1.1.9 Ensure usb storage kernel module is not available
• 6.2.3.10 Ensure successful file system mounts are collected

M1035

• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.5 Ensure sshd banner is configured

M1036

• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.16 Ensure sshd MaxAuthTries is configured

M1037

• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports

M1038

• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.6.2 Ensure nodev option set on /var/log partition

M1040

• 1.5.2 Ensure ptrace_scope is restricted

M1041

• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.6 Ensure sshd Ciphers are configured
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.4 Ensure strong password hashing algorithm is configured

M1042

• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 3.1.1 Ensure IPv6 status is identified
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled

M1046

• 1.4.1 Ensure bootloader password is set

M1047

• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected

M1048

• 1.3.1.4 Ensure all AppArmor Profiles are enforcing

M1050

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.5.1 Ensure address space layout randomization is enabled
• 1.7.10 Ensure XDCMP is not enabled

M1051

• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed

M1053

• 3.3.3 Ensure bogus ICMP responses are ignored
• 6.1.2.3 Ensure journald Compress is configured
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted

M1057

• 1.5.3 Ensure core dumps are restricted
• 6.1.3.1 Ensure rsyslog is installed

MA1027

• 5.4.1.2 Ensure minimum password days is configured

Mandatory Access Control

• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing

Manual

• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 3.1.1 Ensure IPv6 status is identified
• 4.2.5 Ensure ufw outbound connections are configured
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.8 Ensure logrotate is configured
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 7.1.13 Ensure SUID and SGID files are reviewed

Network

• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 3.3.9 Ensure suspicious packets are logged

Network Configuration

• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 4.3.5 Ensure nftables base chains exist
• 4.4.3.2 Ensure ip6tables loopback traffic is configured

Network Parameters (Host and Router)

• 3.3.11 Ensure IPv6 router advertisements are not accepted

Nothing should be returned

• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group

Package Management

• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed

Pluggable Authentication Modules

• 5.3.1.1 Ensure latest version of pam is installed
• 5.3.1.2 Ensure libpam-modules is installed
• 5.3.1.3 Ensure libpam-pwquality is installed
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok

Secure Boot Settings

• 1.4.2 Ensure access to bootloader config is configured

Server

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.5.1 Ensure address space layout randomization is enabled
• 1.5.2 Ensure ptrace_scope is restricted
• 1.5.3 Ensure core dumps are restricted
• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.10 Ensure XDCMP is not enabled
• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.1 Ensure cron daemon is enabled and active
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 3.3.9 Ensure suspicious packets are logged
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.5 Ensure sshd banner is configured
• 5.1.6 Ensure sshd Ciphers are configured
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.3.1.1 Ensure latest version of pam is installed
• 5.3.1.2 Ensure libpam-modules is installed
• 5.3.1.3 Ensure libpam-pwquality is installed
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.1 Ensure nologin is not listed in /etc/shells
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.1.4 Ensure only one logging system is in use
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.1 Ensure AIDE is installed
• 6.3.2 Ensure filesystem integrity is regularly checked
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist
• 7.2.9 Ensure local interactive user home directories are configured

Services

• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.1 Ensure cron daemon is enabled and active
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users

System Auditing

• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured

System File Permissions

• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured

System Logging

• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.1.4 Ensure only one logging system is in use
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured

System Maintenance

• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist
• 7.2.9 Ensure local interactive user home directories are configured

T083

• 5.4.3.3 Ensure default user umask is configured

T1003

• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.4 Ensure shadow group is empty

T1003.008

• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.4 Ensure shadow group is empty

T1005

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.5.3 Ensure core dumps are restricted
• 2.1.14 Ensure samba file server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 6.1.3.1 Ensure rsyslog is installed

T1011

• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use

T1018

• 1.6.3 Ensure remote login warning banner is configured properly
• 2.1.21 Ensure mail transfer agent is configured for local-only mode

T1021

• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.4 Ensure SSH access is limited

T1021.004

• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.4 Ensure SSH access is limited

T1036

• 6.3.2 Ensure filesystem integrity is regularly checked

T1036.002

• 6.3.2 Ensure filesystem integrity is regularly checked

T1036.003

• 6.3.2 Ensure filesystem integrity is regularly checked

T1036.004

• 6.3.2 Ensure filesystem integrity is regularly checked

T1036.005

• 6.3.2 Ensure filesystem integrity is regularly checked

T1039

• 2.1.14 Ensure samba file server services are not in use
• 2.1.9 Ensure network file system services are not in use

T1040

• 1.7.10 Ensure XDCMP is not enabled
• 2.2.2 Ensure rsh client is not installed
• 2.2.4 Ensure telnet client is not installed
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.6 Ensure sshd Ciphers are configured

T1052

• 1.1.1.9 Ensure usb storage kernel module is not available

T1052.001

• 1.1.1.9 Ensure usb storage kernel module is not available

T1053

• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users

T1053.003

• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users

T1055

• 1.5.2 Ensure ptrace_scope is restricted

T1055.008

• 1.5.2 Ensure ptrace_scope is restricted

T1056

• 1.7.10 Ensure XDCMP is not enabled

T1056.001

• 1.7.10 Ensure XDCMP is not enabled

T1068

• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.5.1 Ensure address space layout randomization is enabled
• 2.1.1 Ensure autofs services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available

T1070

• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool

T1070.002

• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool

T1078

• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.2 Ensure sudo commands use pty
• 5.3.3.3.1 Ensure password history remember is configured
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.2 Ensure default user shell timeout is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist

T1078.001

• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist

T1078.002

• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past

T1078.003

• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.2 Ensure sudo commands use pty
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist

T1078.004

• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.6 Ensure all users last password change date is in the past

T1082

• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly

T1083

• 2.1.14 Ensure samba file server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 5.4.2.6 Ensure root user umask is configured
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool

T1087

• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled

T1087.001

• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled

T1087.002

• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled

T1091

• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled

T1098

• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured

T1098.004

• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured

T1105

• 2.1.13 Ensure rsync services are not in use

T1110

• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.6 Ensure all users last password change date is in the past

T1110.001

• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.6 Ensure all users last password change date is in the past

T1110.002

• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.6 Ensure all users last password change date is in the past

T1110.003

• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.6 Ensure all users last password change date is in the past

T1110.004

• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.3.3.3.1 Ensure password history remember is configured
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.6 Ensure all users last password change date is in the past

T1135

• 2.1.14 Ensure samba file server services are not in use
• 2.1.9 Ensure network file system services are not in use

T1152

• 7.2.10 Ensure local interactive user dot files access is configured

T1152.003

• 7.2.10 Ensure local interactive user dot files access is configured

T1152.004

• 7.2.10 Ensure local interactive user dot files access is configured

T1178.001

• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled

T1178.002

• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled

T1178.003

• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled

T1178.004

• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled

T1195

• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed

T1195.001

• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed

T1195.002

• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed

T1200

• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition

T1203

• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed

T1204

• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 5.4.2.4 Ensure root account access is controlled

T1204.002

• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 5.4.2.4 Ensure root account access is controlled

T1204.02

• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition

T1210

• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 5.1.8 Ensure sshd DisableForwarding is enabled

T1211

• 2.1.1 Ensure autofs services are not in use

T1212

• 2.1.1 Ensure autofs services are not in use

T1222

• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.9 Ensure local interactive user home directories are configured

T1222.001

• 7.2.10 Ensure local interactive user dot files access is configured

T1222.002

• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.9 Ensure local interactive user home directories are configured

T1456

• 1.7.5 Ensure GDM screen locks cannot be overridden

T1461

• 1.7.4 Ensure GDM screen locks when the user is idle

T1497

• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode

T1498

• 2.1.12 Ensure rpcbind services are not in use
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.7 Ensure Reverse Path Filtering is enabled

T1498.001

• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.7 Ensure Reverse Path Filtering is enabled

T1498.002

• 2.1.12 Ensure rpcbind services are not in use

T1499

• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured

T1499.001

• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 3.3.10 Ensure TCP SYN Cookies is enabled

T1499.002

• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured

T1542

• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured

T1543

• 1.7.1 Ensure GNOME Display Manager is removed
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured

T1543.002

• 1.7.1 Ensure GNOME Display Manager is removed
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured

T1548

• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.13 Ensure SUID and SGID files are reviewed

T1548.001

• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 7.1.13 Ensure SUID and SGID files are reviewed

T1548.003

• 5.2.2 Ensure sudo commands use pty

T1552

• 5.1.2 Ensure permissions on SSH private host key files are configured

T1552.004

• 5.1.2 Ensure permissions on SSH private host key files are configured

T1557

• 1.7.10 Ensure XDCMP is not enabled
• 3.1.1 Ensure IPv6 status is identified
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.6 Ensure sshd Ciphers are configured

T1562

• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.1 Ensure cron daemon is enabled and active
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.9 Ensure suspicious packets are logged
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports
• 5.1.14 Ensure sshd LogLevel is configured
• 5.2.3 Ensure sudo log file exists
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected

T1562.001

• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.1 Ensure cron daemon is enabled and active
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.3.20 Ensure the audit configuration is immutable

T1562.004

• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports

T1562.006

• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.9 Ensure suspicious packets are logged
• 5.1.14 Ensure sshd LogLevel is configured
• 5.2.3 Ensure sudo log file exists
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected

T1565

• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.3.1 Ensure AIDE is installed
• 6.3.2 Ensure filesystem integrity is regularly checked

T1565.001

• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 6.3.1 Ensure AIDE is installed
• 6.3.2 Ensure filesystem integrity is regularly checked

T1565.003

• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing

T1570

• 2.1.13 Ensure rsync services are not in use
• 2.2.1 Ensure NIS Client is not installed

T1590

• 3.3.8 Ensure source routed packets are not accepted

T1590.005

• 3.3.8 Ensure source routed packets are not accepted

T1592

• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly

T1592.004

• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly

T1595

• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled

T1595.001

• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled

T1595.002

• 3.1.1 Ensure IPv6 status is identified
• 3.1.2 Ensure wireless interfaces are disabled

TA0001

• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.5 Ensure sshd banner is configured
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.2 Ensure sudo commands use pty
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.2.1 Ensure root is the only UID 0 account
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.3.1 Ensure AIDE is installed

TA0002

• 1.5.1 Ensure address space layout randomization is enabled
• 1.7.1 Ensure GNOME Display Manager is removed
• 1.7.10 Ensure XDCMP is not enabled
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 6.2.3.6 Ensure use of privileged commands are collected

TA0003

• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.4.1 Ensure bootloader password is set
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.2.2 Ensure sudo commands use pty
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group

TA0004

• 5.2.1 Ensure sudo is installed
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist

TA0005

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.2 Ensure access to bootloader config is configured
• 1.5.2 Ensure ptrace_scope is restricted
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.4.1.1 Ensure cron daemon is enabled and active
• 3.3.9 Ensure suspicious packets are logged
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.5 Ensure nftables base chains exist
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.2.7 Ensure access to the su command is restricted
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.2 Ensure default user shell timeout is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.4 Ensure shadow group is empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.9 Ensure local interactive user home directories are configured

TA0006

• 1.1.2.4.1 Ensure separate partition exists for /var
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.6 Ensure sshd Ciphers are configured
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.2.4 Ensure root account access is controlled

TA0007

• 1.4.2 Ensure access to bootloader config is configured
• 1.5.3 Ensure core dumps are restricted
• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly
• 1.7.2 Ensure GDM login banner is configured
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.8 Ensure source routed packets are not accepted
• 5.1.5 Ensure sshd banner is configured
• 5.4.2.6 Ensure root user umask is configured
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool
• 7.1.12 Ensure no files or directories without an owner and a group exist

TA0008

• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.20 Ensure X window server services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 3.1.1 Ensure IPv6 status is identified
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.4 Ensure SSH access is limited
• 5.1.8 Ensure sshd DisableForwarding is enabled

TA0009

• 3.3.1 Ensure IP forwarding is disabled
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.6 Ensure secure ICMP redirects are not accepted

TA0010

• 1.1.1.9 Ensure usb storage kernel module is not available
• 3.1.2 Ensure wireless interfaces are disabled
• 3.1.3 Ensure bluetooth services are not in use
• 6.2.3.10 Ensure successful file system mounts are collected

TA0011

• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.4 Ensure a nftables table exists
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports

TA0027

• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden

TA0040

• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.2.2.1 Ensure audit log storage size is configured
• 6.3.2 Ensure filesystem integrity is regularly checked

User Accounts and Environment

• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.1 Ensure nologin is not listed in /etc/shells
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured

Workstation

• 1.1.1.1 Ensure cramfs kernel module is not available
• 1.1.1.10 Ensure unused filesystems kernel modules are not available
• 1.1.1.2 Ensure freevxfs kernel module is not available
• 1.1.1.3 Ensure hfs kernel module is not available
• 1.1.1.4 Ensure hfsplus kernel module is not available
• 1.1.1.5 Ensure jffs2 kernel module is not available
• 1.1.1.6 Ensure overlayfs kernel module is not available
• 1.1.1.7 Ensure squashfs kernel module is not available
• 1.1.1.8 Ensure udf kernel module is not available
• 1.1.1.9 Ensure usb storage kernel module is not available
• 1.1.2.1.2 Ensure nodev option set on /tmp partition
• 1.1.2.1.3 Ensure nosuid option set on /tmp partition
• 1.1.2.1.4 Ensure noexec option set on /tmp partition
• 1.1.2.2.1 Ensure /dev/shm is a separate partition
• 1.1.2.2.1 Ensure /tmp is a separate partition
• 1.1.2.2.2 Ensure nodev option set on /dev/shm partition
• 1.1.2.2.3 Ensure nosuid option set on /dev/shm partition
• 1.1.2.2.4 Ensure noexec option set on /dev/shm partition
• 1.1.2.3.1 Ensure separate partition exists for /home
• 1.1.2.3.2 Ensure nodev option set on /home partition
• 1.1.2.3.3 Ensure nosuid option set on /home partition
• 1.1.2.4.1 Ensure separate partition exists for /var
• 1.1.2.4.2 Ensure nodev option set on /var partition
• 1.1.2.4.3 Ensure nosuid option set on /var partition
• 1.1.2.5.1 Ensure separate partition exists for /var/tmp
• 1.1.2.5.2 Ensure nodev option set on /var/tmp partition
• 1.1.2.5.3 Ensure nosuid option set on /var/tmp partition
• 1.1.2.5.4 Ensure noexec option set on /var/tmp partition
• 1.1.2.6.1 Ensure separate partition exists for /var/log
• 1.1.2.6.2 Ensure nodev option set on /var/log partition
• 1.1.2.6.3 Ensure nosuid option set on /var/log partition
• 1.1.2.6.4 Ensure noexec option set on /var/log partition
• 1.1.2.7.1 Ensure separate partition exists for /var/log/audit
• 1.1.2.7.2 Ensure nodev option set on /var/log/audit partition
• 1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition
• 1.1.2.7.4 Ensure noexec option set on /var/log/audit partition
• 1.2.1.1 Ensure GPG keys are configured
• 1.2.1.2 Ensure package manager repositories are configured
• 1.2.2.1 Ensure updates, patches, and additional security software are installed
• 1.3.1.1 Ensure AppArmor is installed
• 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration
• 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
• 1.3.1.4 Ensure all AppArmor Profiles are enforcing
• 1.4.1 Ensure bootloader password is set
• 1.4.2 Ensure access to bootloader config is configured
• 1.5.1 Ensure address space layout randomization is enabled
• 1.5.2 Ensure ptrace_scope is restricted
• 1.5.3 Ensure core dumps are restricted
• 1.6.1 Ensure message of the day is configured properly
• 1.6.2 Ensure local login warning banner is configured properly
• 1.6.3 Ensure remote login warning banner is configured properly
• 1.6.4 Ensure access to /etc/motd is configured
• 1.6.5 Ensure access to /etc/issue is configured
• 1.6.6 Ensure access to /etc/issue.net is configured
• 1.7.10 Ensure XDCMP is not enabled
• 1.7.3 Ensure GDM disable-user-list option is enabled
• 1.7.4 Ensure GDM screen locks when the user is idle
• 1.7.5 Ensure GDM screen locks cannot be overridden
• 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden
• 1.7.8 Ensure GDM autorun-never is enabled
• 1.7.9 Ensure GDM autorun-never is not overridden
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled
• 2.1.1 Ensure autofs services are not in use
• 2.1.10 Ensure nis server services are not in use
• 2.1.11 Ensure print server services are not in use
• 2.1.12 Ensure rpcbind services are not in use
• 2.1.13 Ensure rsync services are not in use
• 2.1.14 Ensure samba file server services are not in use
• 2.1.15 Ensure snmp services are not in use
• 2.1.16 Ensure tftp server services are not in use
• 2.1.17 Ensure web proxy server services are not in use
• 2.1.18 Ensure web server services are not in use
• 2.1.19 Ensure xinetd services are not in use
• 2.1.2 Ensure avahi daemon services are not in use
• 2.1.21 Ensure mail transfer agent is configured for local-only mode
• 2.1.22 Ensure only approved services are listening on a network interface
• 2.1.3 Ensure dhcp server services are not in use
• 2.1.4 Ensure dns server services are not in use
• 2.1.5 Ensure dnsmasq services are not in use
• 2.1.6 Ensure ftp server services are not in use
• 2.1.7 Ensure ldap server services are not in use
• 2.1.8 Ensure message access server services are not in use
• 2.1.9 Ensure network file system services are not in use
• 2.2.1 Ensure NIS Client is not installed
• 2.2.2 Ensure rsh client is not installed
• 2.2.3 Ensure talk client is not installed
• 2.2.4 Ensure telnet client is not installed
• 2.2.5 Ensure LDAP client is not installed
• 2.2.6 Ensure ftp client is not installed
• 2.3.1.1 Ensure a single time synchronization daemon is in use
• 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver
• 2.3.2.2 Ensure systemd-timesyncd is enabled and running
• 2.3.3.1 Ensure chrony is configured with authorized timeserver
• 2.3.3.2 Ensure chrony is running as user _chrony
• 2.3.3.3 Ensure chrony is enabled and running
• 2.4.1.1 Ensure cron daemon is enabled and active
• 2.4.1.2 Ensure permissions on /etc/crontab are configured
• 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured
• 2.4.1.4 Ensure permissions on /etc/cron.daily are configured
• 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured
• 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured
• 2.4.1.7 Ensure permissions on /etc/cron.d are configured
• 2.4.1.8 Ensure cron is restricted to authorized users
• 2.4.2.1 Ensure at is restricted to authorized users
• 3.1.1 Ensure IPv6 status is identified
• 3.1.3 Ensure bluetooth services are not in use
• 3.2.1 Ensure dccp kernel module is not available
• 3.2.2 Ensure tipc kernel module is not available
• 3.2.3 Ensure rds kernel module is not available
• 3.2.4 Ensure sctp kernel module is not available
• 3.3.1 Ensure IP forwarding is disabled
• 3.3.10 Ensure TCP SYN Cookies is enabled
• 3.3.11 Ensure IPv6 router advertisements are not accepted
• 3.3.2 Ensure packet redirect sending is disabled
• 3.3.3 Ensure bogus ICMP responses are ignored
• 3.3.4 Ensure broadcast ICMP requests are ignored
• 3.3.5 Ensure ICMP redirects are not accepted
• 3.3.6 Ensure secure ICMP redirects are not accepted
• 3.3.7 Ensure Reverse Path Filtering is enabled
• 3.3.8 Ensure source routed packets are not accepted
• 3.3.9 Ensure suspicious packets are logged
• 4.1.1 Ensure a single firewall configuration utility is in use
• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw
• 4.2.3 Ensure ufw service is enabled
• 4.2.4 Ensure ufw loopback traffic is configured
• 4.2.5 Ensure ufw outbound connections are configured
• 4.2.6 Ensure ufw firewall rules exist for all open ports
• 4.2.7 Ensure ufw default deny firewall policy
• 4.3.1 Ensure nftables is installed
• 4.3.10 Ensure nftables rules are permanent
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables
• 4.3.3 Ensure iptables are flushed with nftables
• 4.3.4 Ensure a nftables table exists
• 4.3.5 Ensure nftables base chains exist
• 4.3.7 Ensure nftables outbound and established connections are configured
• 4.3.8 Ensure nftables default deny firewall policy
• 4.3.9 Ensure nftables service is enabled
• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables
• 4.4.1.3 Ensure ufw is not in use with iptables
• 4.4.2.1 Ensure iptables default deny firewall policy
• 4.4.2.2 Ensure iptables loopback traffic is configured
• 4.4.2.3 Ensure iptables outbound and established connections are configured
• 4.4.2.4 Ensure iptables firewall rules exist for all open ports
• 4.4.3.1 Ensure ip6tables default deny firewall policy
• 4.4.3.2 Ensure ip6tables loopback traffic is configured
• 4.4.3.3 Ensure ip6tables outbound and established connections are configured
• 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports
• 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured
• 5.1.10 Ensure sshd HostbasedAuthentication is disabled
• 5.1.11 Ensure sshd IgnoreRhosts is enabled
• 5.1.12 Ensure sshd KexAlgorithms is configured
• 5.1.13 Ensure sshd LoginGraceTime is configured
• 5.1.14 Ensure sshd LogLevel is configured
• 5.1.15 Ensure sshd MACs are configured
• 5.1.16 Ensure sshd MaxAuthTries is configured
• 5.1.17 Ensure sshd MaxSessions is configured
• 5.1.18 Ensure sshd MaxStartups is configured
• 5.1.19 Ensure sshd PermitEmptyPasswords is disabled
• 5.1.2 Ensure permissions on SSH private host key files are configured
• 5.1.20 Ensure sshd PermitRootLogin is disabled
• 5.1.21 Ensure sshd PermitUserEnvironment is disabled
• 5.1.22 Ensure sshd UsePAM is enabled
• 5.1.3 Ensure permissions on SSH public host key files are configured
• 5.1.4 Ensure SSH access is limited
• 5.1.5 Ensure sshd banner is configured
• 5.1.6 Ensure sshd Ciphers are configured
• 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
• 5.1.8 Ensure sshd DisableForwarding is enabled
• 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
• 5.2.1 Ensure sudo is installed
• 5.2.2 Ensure sudo commands use pty
• 5.2.3 Ensure sudo log file exists
• 5.2.4 Ensure users must provide password for privilege escalation
• 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally
• 5.2.6 Ensure sudo authentication timeout is configured correctly
• 5.2.7 Ensure access to the su command is restricted
• 5.3.1.1 Ensure latest version of pam is installed
• 5.3.1.2 Ensure libpam-modules is installed
• 5.3.1.3 Ensure libpam-pwquality is installed
• 5.3.2.1 Ensure pam_unix module is enabled
• 5.3.2.2 Ensure pam_faillock module is enabled
• 5.3.2.3 Ensure pam_pwquality module is enabled
• 5.3.2.4 Ensure pam_history module is enabled
• 5.3.3.1.1 Ensure password failed attempts lockout is configured
• 5.3.3.1.2 Ensure password unlock time is configured
• 5.3.3.1.3 Ensure password failed attempts lockout includes root account
• 5.3.3.2.1 Ensure password number of changed characters is configured
• 5.3.3.2.2 Ensure minimum password length is configured
• 5.3.3.2.4 Ensure password same consecutive characters is configured
• 5.3.3.2.5 Ensure password maximum sequential characters is configured
• 5.3.3.2.6 Ensure password dictionary check is enabled
• 5.3.3.2.7 Ensure password quality checking is enforced
• 5.3.3.2.8 Ensure password quality is enforced for the root user
• 5.3.3.3.1 Ensure password history remember is configured
• 5.3.3.3.2 Ensure password history is enforced for the root user
• 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok
• 5.3.3.4.1 Ensure pam_unix does not include nullok
• 5.3.3.4.2 Ensure pam_unix does not include remember
• 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm
• 5.3.3.4.4 Ensure pam_unix includes use_authtok
• 5.4.1.1 Ensure password expiration is configured
• 5.4.1.2 Ensure minimum password days is configured
• 5.4.1.3 Ensure password expiration warning days is configured
• 5.4.1.4 Ensure strong password hashing algorithm is configured
• 5.4.1.5 Ensure inactive password lock is configured
• 5.4.1.6 Ensure all users last password change date is in the past
• 5.4.2.1 Ensure root is the only UID 0 account
• 5.4.2.2 Ensure root is the only GID 0 account
• 5.4.2.3 Ensure group root is the only GID 0 group
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.4 Ensure root account access is controlled
• 5.4.2.6 Ensure root user umask is configured
• 5.4.2.7 Ensure system accounts do not have a valid login shell
• 5.4.2.8 Ensure accounts without a valid login shell are locked
• 5.4.3.1 Ensure nologin is not listed in /etc/shells
• 5.4.3.2 Ensure default user shell timeout is configured
• 5.4.3.3 Ensure default user umask is configured
• 6.1.1.1 Ensure journald service is enabled and active
• 6.1.1.2 Ensure journald log file access is configured
• 6.1.1.3 Ensure journald log file rotation is configured
• 6.1.1.4 Ensure only one logging system is in use
• 6.1.2.1.1 Ensure systemd-journal-remote is installed
• 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured
• 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active
• 6.1.2.1.4 Ensure systemd-journal-remote service is not in use
• 6.1.2.2 Ensure journald ForwardToSyslog is disabled
• 6.1.2.3 Ensure journald Compress is configured
• 6.1.2.4 Ensure journald Storage is configured
• 6.1.3.1 Ensure rsyslog is installed
• 6.1.3.2 Ensure rsyslog service is enabled and active
• 6.1.3.3 Ensure journald is configured to send logs to rsyslog
• 6.1.3.4 Ensure rsyslog log file creation mode is configured
• 6.1.3.5 Ensure rsyslog logging is configured
• 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
• 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client
• 6.1.3.8 Ensure logrotate is configured
• 6.1.4.1 Ensure access to all logfiles has been configured
• 6.2.1.1 Ensure auditd packages are installed
• 6.2.1.2 Ensure auditd service is enabled and active
• 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
• 6.2.1.4 Ensure audit_backlog_limit is sufficient
• 6.2.2.1 Ensure audit log storage size is configured
• 6.2.2.2 Ensure audit logs are not automatically deleted
• 6.2.2.3 Ensure system is disabled when audit logs are full
• 6.2.2.4 Ensure system warns when audit logs are low on space
• 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected
• 6.2.3.10 Ensure successful file system mounts are collected
• 6.2.3.11 Ensure session initiation information is collected
• 6.2.3.12 Ensure login and logout events are collected
• 6.2.3.13 Ensure file deletion events by users are collected
• 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
• 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected
• 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected
• 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected
• 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected
• 6.2.3.19 Ensure kernel module loading unloading and modification is collected
• 6.2.3.2 Ensure actions as another user are always logged
• 6.2.3.20 Ensure the audit configuration is immutable
• 6.2.3.21 Ensure the running and on disk configuration is the same
• 6.2.3.3 Ensure events that modify the sudo log file are collected
• 6.2.3.4 Ensure events that modify date and time information are collected
• 6.2.3.5 Ensure events that modify the system's network environment are collected
• 6.2.3.6 Ensure use of privileged commands are collected
• 6.2.3.7 Ensure unsuccessful file access attempts are collected
• 6.2.3.8 Ensure events that modify user/group information are collected
• 6.2.3.9 Ensure discretionary access control permission modification events are collected
• 6.2.4.1 Ensure audit log files mode is configured
• 6.2.4.10 Ensure audit tools group owner is configured
• 6.2.4.2 Ensure audit log files owner is configured
• 6.2.4.3 Ensure audit log files group owner is configured
• 6.2.4.4 Ensure the audit log file directory mode is configured
• 6.2.4.5 Ensure audit configuration files mode is configured
• 6.2.4.6 Ensure audit configuration files owner is configured
• 6.2.4.7 Ensure audit configuration files group owner is configured
• 6.2.4.8 Ensure audit tools mode is configured
• 6.2.4.9 Ensure audit tools owner is configured
• 6.3.1 Ensure AIDE is installed
• 6.3.2 Ensure filesystem integrity is regularly checked
• 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tool
• 7.1.1 Ensure permissions on /etc/passwd are configured
• 7.1.10 Ensure permissions on /etc/security/opasswd are configured
• 7.1.11 Ensure world writable files and directories are secured
• 7.1.12 Ensure no files or directories without an owner and a group exist
• 7.1.13 Ensure SUID and SGID files are reviewed
• 7.1.2 Ensure permissions on /etc/passwd- are configured
• 7.1.3 Ensure permissions on /etc/group are configured
• 7.1.4 Ensure permissions on /etc/group- are configured
• 7.1.5 Ensure permissions on /etc/shadow are configured
• 7.1.6 Ensure permissions on /etc/shadow- are configured
• 7.1.7 Ensure permissions on /etc/gshadow are configured
• 7.1.8 Ensure permissions on /etc/gshadow- are configured
• 7.1.9 Ensure permissions on /etc/shells are configured
• 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords
• 7.2.10 Ensure local interactive user dot files access is configured
• 7.2.2 Ensure /etc/shadow password fields are not empty
• 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group
• 7.2.4 Ensure shadow group is empty
• 7.2.5 Ensure no duplicate UIDs exist
• 7.2.6 Ensure no duplicate GIDs exist
• 7.2.7 Ensure no duplicate user names exist
• 7.2.8 Ensure no duplicate group names exist
• 7.2.9 Ensure local interactive user home directories are configured