DISA_STIG_Oracle_Linux_5_v1r14.audit from DISA Oracle Linux 5 v1r14 STIG

GEN000000-LNX00320 - The system must not have special privilege accounts, such as shutdown and halt - /etc/passwd halt'

800-53|AC-3

CAT|I

CCI|CCI-000225

CCI|CCI-000764

Rule-ID|SV-62797r1_rule

STIG-ID|GEN000000-LNX00320

Vuln-ID|V-4268

GEN000000-LNX00320 - The system must not have special privilege accounts, such as shutdown and halt - /etc/passwd reboot'

GEN000000-LNX00320 - The system must not have special privilege accounts, such as shutdown and halt - /etc/passwd shutdown'

GEN000000-LNX00320 - The system must not have special privilege accounts, such as shutdown and halt - /etc/shadow halt'

GEN000000-LNX00320 - The system must not have special privilege accounts, such as shutdown and halt - /etc/shadow reboot'

GEN000000-LNX00320 - The system must not have special privilege accounts, such as shutdown and halt - /etc/shadow shutdown'

GEN000000-LNX00360 - The X server must have the correct options enabled - '-audit = 4'

800-53|AU-12

CAT|II

CCI|CCI-000366

Rule-ID|SV-62805r1_rule

STIG-ID|GEN000000-LNX00360

Vuln-ID|V-1021

GEN000000-LNX00360 - The X server must have the correct options enabled - '-auth'

800-53|AC-11

CSCv6|16.5

GEN000000-LNX00360 - The X server must have the correct options enabled - '-s <= 15'

800-53|CM-6

CSCv6|3.1

GEN000000-LNX00360 - The X server must have the correct options enabled - ':0 /usr/bin/X:0'

GEN000000-LNX00380 - An X server must have none of the following options enabled: -ac, -core (except for debugging purposes), or -nolock - '-ac'

Rule-ID|SV-62815r1_rule

STIG-ID|GEN000000-LNX00380

Vuln-ID|V-1022

GEN000000-LNX00380 - An X server must have none of the following options enabled: -ac, -core (except for debugging purposes), or -nolock - '-core'

GEN000000-LNX00380 - An X server must have none of the following options enabled: -ac, -core (except for debugging purposes), or -nolock - '-nolock'

GEN000000-LNX00400 - The /etc/security/access.conf file must be owned by root.

Rule-ID|SV-62875r1_rule

STIG-ID|GEN000000-LNX00400

Vuln-ID|V-1025

GEN000000-LNX00420 - The /etc/security/access.conf file must have a privileged group owner.

Rule-ID|SV-62901r1_rule

STIG-ID|GEN000000-LNX00420

Vuln-ID|V-1054

GEN000000-LNX00440 - The /etc/security/access.conf file must have mode 0640 or less permissive.

Rule-ID|SV-62903r1_rule

STIG-ID|GEN000000-LNX00440

Vuln-ID|V-1055

GEN000000-LNX00450 - The access.conf file must not have an extended ACL.

800-53|AC-3(4)

Rule-ID|SV-62909r1_rule

STIG-ID|GEN000000-LNX00450

Vuln-ID|V-22595

GEN000000-LNX00480 - The /etc/sysctl.conf file must be owned by root.

Rule-ID|SV-62929r1_rule

STIG-ID|GEN000000-LNX00480

Vuln-ID|V-4334

GEN000000-LNX00500 - The /etc/sysctl.conf file must be group-owned by root.

Rule-ID|SV-62951r1_rule

STIG-ID|GEN000000-LNX00500

Vuln-ID|V-4335

GEN000000-LNX00520 - The /etc/sysctl.conf file must have mode 0600 or less permissive.

Rule-ID|SV-62963r1_rule

STIG-ID|GEN000000-LNX00520

Vuln-ID|V-4336

GEN000000-LNX00530 - The /etc/sysctl.conf file must not have an extended ACL.

Rule-ID|SV-62983r1_rule

STIG-ID|GEN000000-LNX00530

Vuln-ID|V-22596

GEN000000-LNX00560 - The Linux NFS Server must not have the insecure file locking option.

800-53|AC-6

Rule-ID|SV-62985r1_rule

STIG-ID|GEN000000-LNX00560

Vuln-ID|V-4339

GEN000000-LNX00580 - The x86 CTRL-ALT-DELETE key sequence must be disabled.

800-53|SC-6

Rule-ID|SV-62991r1_rule

STIG-ID|GEN000000-LNX00580

Vuln-ID|V-4342

GEN000000-LNX00600 - The Linux PAM system must not grant sole access to admin privileges to the first user who logs into the console.

Rule-ID|SV-63003r1_rule

STIG-ID|GEN000000-LNX00600

Vuln-ID|V-4346

GEN000000-LNX00620 - The /etc/securetty file must be group-owned by root, sys, or bin.

Rule-ID|SV-63013r1_rule

STIG-ID|GEN000000-LNX00620

Vuln-ID|V-12038

GEN000000-LNX00640 - The /etc/securetty file must be owned by root.

Rule-ID|SV-63061r1_rule

STIG-ID|GEN000000-LNX00640

Vuln-ID|V-12039

GEN000000-LNX00660 - The /etc/securetty file must have mode 0600 or less permissive.

Rule-ID|SV-63071r1_rule

STIG-ID|GEN000000-LNX00660

Vuln-ID|V-12040

GEN000000-LNX00720 - Auditing must be enabled at boot by setting a kernel parameter.

CAT|III

Rule-ID|SV-63081r1_rule

STIG-ID|GEN000000-LNX00720

Vuln-ID|V-22598

GEN000000-LNX00800 - The system must use a Linux Security Module configured to limit the privileges of system services - 'SELINUX = enforcing'

800-53|AC-3(3)

Rule-ID|SV-63085r1_rule

STIG-ID|GEN000000-LNX00800

Vuln-ID|V-22584

GEN000000-LNX00800 - The system must use a Linux Security Module configured to limit the privileges of system services - 'SELINUXTYPE = targeted or strict'

GEN000000-LNX001431 - The /etc/gshadow file must be owned by root.

800-53|IA-5(6)

Rule-ID|SV-62667r1_rule

STIG-ID|GEN000000-LNX001431

Vuln-ID|V-22341

GEN000000-LNX001432 - The /etc/gshadow file must be group-owned by root.

Rule-ID|SV-62681r1_rule

STIG-ID|GEN000000-LNX001432

Vuln-ID|V-22342

GEN000000-LNX001433 - The /etc/gshadow file must have mode 0400.

Rule-ID|SV-62697r1_rule

STIG-ID|GEN000000-LNX001433

Vuln-ID|V-22343

GEN000000-LNX001434 - The /etc/gshadow file must not have an extended ACL.

Rule-ID|SV-62711r1_rule

STIG-ID|GEN000000-LNX001434

Vuln-ID|V-22344

GEN000000-LNX001476 - The /etc/gshadow file must not contain any group password hashes.

800-53|IA-5

Rule-ID|SV-62767r1_rule

STIG-ID|GEN000000-LNX001476

Vuln-ID|V-22349

GEN000020 - The system must require authentication upon booting into single-user and maintenance modes.

800-53|SI-7(9)

CCI|CCI-000213

Rule-ID|SV-63087r2_rule

STIG-ID|GEN000020

Vuln-ID|V-756

GEN000100 - The operating system must be a supported release.

800-53|CM-8

CCI|CCI-001230

Rule-ID|SV-63095r1_rule

STIG-ID|GEN000100

Vuln-ID|V-11940

GEN000120 - System security patches and updates must be installed and up-to-date.

CCI|CCI-001227

Rule-ID|SV-63099r1_rule

STIG-ID|GEN000120

Vuln-ID|V-783

GEN000140-2 - A file integrity baseline including cryptographic hashes must be created - '/etc/aide.conf must exist'

800-53|SI-7(1)

CCI|CCI-000293

Rule-ID|SV-63101r1_rule

STIG-ID|GEN000140-2

Vuln-ID|V-27250

GEN000140-2 - A file integrity baseline including cryptographic hashes must be created - 'cryptographic hash is used '

GEN000140-2 - A file integrity baseline including cryptographic hashes must be created - 'database location'

GEN000140-3 - A file integrity baseline including cryptographic hashes must be maintained - '/etc/aide.conf exists'

Rule-ID|SV-63129r1_rule

STIG-ID|GEN000140-3

Vuln-ID|V-27251

GEN000140-3 - A file integrity baseline including cryptographic hashes must be maintained - 'database has been configured'

GEN000220 - A file integrity tool must be used at least weekly to check for unauthorized file changes, particularly the addition of unauthorized system libraries or binaries, or for unauthorized modification to authorized system libraries or binaries.

CCI|CCI-001069

Rule-ID|SV-63133r3_rule

STIG-ID|GEN000220

Vuln-ID|V-11945

GEN000240 - The system clock must be synchronized to an authoritative DoD time source.

800-53|AU-8(1)

CCI|CCI-001492

CSCv6|6.1

Rule-ID|SV-63137r1_rule

STIG-ID|GEN000240

Vuln-ID|V-4301

GEN000241 - The system clock must be synchronized continuously - 'maxpoll 10'

Rule-ID|SV-63143r4_rule

STIG-ID|GEN000241

Vuln-ID|V-22290

GEN000241 - The system clock must be synchronized continuously.

GEN000242 - The system must use at least two time sources for clock synchronization - '/etc/ntp.conf'

800-53|AU-8

CCI|CCI-000160

Rule-ID|SV-63147r1_rule

STIG-ID|GEN000242

Vuln-ID|V-22291

GEN000242 - The system must use at least two time sources for clock synchronization - 'cron jobs'

GEN000244 - The system must use time sources local to the enclave.

Rule-ID|SV-63153r1_rule

STIG-ID|GEN000244

Vuln-ID|V-22292

GEN000250 - The time synchronization configuration file (such as /etc/ntp.conf) must be owned by root.

Rule-ID|SV-63161r1_rule

STIG-ID|GEN000250

Vuln-ID|V-22294

GEN000251 - The time synchronization configuration file (such as /etc/ntp.conf) must be group-owned by root, bin, or sys - such as /etc/ntp.conf must be group-owned by root, bin, sys, or system.

Rule-ID|SV-63165r1_rule

STIG-ID|GEN000251

Vuln-ID|V-22295

GEN000252 - The time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive.

Rule-ID|SV-63171r1_rule

STIG-ID|GEN000252

Vuln-ID|V-22296

GEN000253 - The time synchronization configuration file (such as /etc/ntp.conf) must not have an extended ACL.

Rule-ID|SV-63177r1_rule

STIG-ID|GEN000253

Vuln-ID|V-22297

GEN000280 - Direct logins must not be permitted to shared, default, application, or utility accounts.

Detections

Analytics

Revision 1.2

Sep 30, 2020

Functional Update