DISA_STIG_Oracle_Linux_8_v2r1.audit from DISA Oracle Linux 8 v2r1 STIG

OL08-00-010000 - OL 8 must be a vendor-supported release.

800-53|CM-6b.

CAT|I

CCI|CCI-000366

Rule-ID|SV-248521r991589_rule

STIG-ID|OL08-00-010000

Vuln-ID|V-248521

OL08-00-010010 - OL 8 vendor-packaged system security patches and updates must be installed and up to date.

CAT|II

Rule-ID|SV-248523r991589_rule

STIG-ID|OL08-00-010010

Vuln-ID|V-248523

OL08-00-010019 - OL 8 must ensure cryptographic verification of vendor software packages.

800-53|CM-5(3)

CCI|CCI-003992

Rule-ID|SV-256978r986384_rule

STIG-ID|OL08-00-010019

Vuln-ID|V-256978

OL08-00-010020 - OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

800-53|AC-17(2)

800-53|MA-4(6)

800-53|MA-4c.

800-53|SC-8

CCI|CCI-000068

CCI|CCI-000877

CCI|CCI-001453

CCI|CCI-002418

CCI|CCI-002890

CCI|CCI-003123

Rule-ID|SV-248524r958408_rule

STIG-ID|OL08-00-010020

Vuln-ID|V-248524

OL08-00-010030 - All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.

800-53|SC-28

800-53|SC-28(1)

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-248525r958552_rule

STIG-ID|OL08-00-010030

Vuln-ID|V-248525

OL08-00-010040 - OL 8 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via an SSH logon.

800-53|AC-8a.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-000048

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-248526r958390_rule

STIG-ID|OL08-00-010040

Vuln-ID|V-248526

OL08-00-010049 - OL 8 must display a banner before granting local or remote access to the system via a graphical user logon.

Rule-ID|SV-248527r958390_rule

STIG-ID|OL08-00-010049

Vuln-ID|V-248527

OL08-00-010050 - OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

Rule-ID|SV-248528r958390_rule

STIG-ID|OL08-00-010050

Vuln-ID|V-248528

OL08-00-010060 - OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

Rule-ID|SV-248529r958390_rule

STIG-ID|OL08-00-010060

Vuln-ID|V-248529

OL08-00-010070 - All OL 8 remote access methods must be monitored.

800-53|AC-17(1)

CCI|CCI-000067

Rule-ID|SV-248530r958406_rule

STIG-ID|OL08-00-010070

Vuln-ID|V-248530

OL08-00-010090 - OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

800-53|IA-5(2)(a)

CCI|CCI-000185

CCI|CCI-004068

Rule-ID|SV-248531r997047_rule

STIG-ID|OL08-00-010090

Vuln-ID|V-248531

OL08-00-010100 - OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-248532r958450_rule

STIG-ID|OL08-00-010100

Vuln-ID|V-248532

OL08-00-010110 - OL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.

800-53|IA-5(1)(d)

CCI|CCI-004062

Rule-ID|SV-248533r986326_rule

STIG-ID|OL08-00-010110

Vuln-ID|V-248533

OL08-00-010120 - OL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.

Rule-ID|SV-248534r986327_rule

STIG-ID|OL08-00-010120

Vuln-ID|V-248534

OL08-00-010121 - The OL 8 operating system must not have accounts configured with blank or null passwords.

Rule-ID|SV-252650r991589_rule

STIG-ID|OL08-00-010121

Vuln-ID|V-252650

OL08-00-010130 - The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.

Rule-ID|SV-248535r986328_rule

STIG-ID|OL08-00-010130

Vuln-ID|V-248535

OL08-00-010140 - OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-248537r958472_rule

STIG-ID|OL08-00-010140

Vuln-ID|V-248537

OL08-00-010141 - OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance.

Rule-ID|SV-248538r958472_rule

STIG-ID|OL08-00-010141

Vuln-ID|V-248538

OL08-00-010149 - OL 8 operating systems booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.

Rule-ID|SV-248539r958472_rule

STIG-ID|OL08-00-010149

Vuln-ID|V-248539

OL08-00-010150 - OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.

Rule-ID|SV-248540r958472_rule

STIG-ID|OL08-00-010150

Vuln-ID|V-248540

OL08-00-010151 - OL 8 operating systems must require authentication upon booting into rescue mode.

Rule-ID|SV-248541r958472_rule

STIG-ID|OL08-00-010151

Vuln-ID|V-248541

OL08-00-010152 - OL 8 operating systems must require authentication upon booting into emergency mode.

Rule-ID|SV-248542r958472_rule

STIG-ID|OL08-00-010152

Vuln-ID|V-248542

OL08-00-010159 - The OL 8 'pam_unix.so' module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-248543r971535_rule

STIG-ID|OL08-00-010159

Vuln-ID|V-248543

OL08-00-010160 - The OL 8 'pam_unix.so' module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

Rule-ID|SV-248544r971535_rule

STIG-ID|OL08-00-010160

Vuln-ID|V-248544

OL08-00-010161 - OL 8 must prevent system daemons from using Kerberos for authentication.

Rule-ID|SV-248545r971535_rule

STIG-ID|OL08-00-010161

Vuln-ID|V-248545

OL08-00-010162 - The krb5-workstation package must not be installed on OL 8.

Rule-ID|SV-248546r971535_rule

STIG-ID|OL08-00-010162

Vuln-ID|V-248546

OL08-00-010163 - The krb5-server package must not be installed on OL 8.

Rule-ID|SV-248547r971535_rule

STIG-ID|OL08-00-010163

Vuln-ID|V-248547

OL08-00-010170 - OL 8 must use a Linux Security Module configured to enforce limits on system services.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-248548r958518_rule

STIG-ID|OL08-00-010170

Vuln-ID|V-248548

OL08-00-010171 - OL 8 must have the 'policycoreutils' package installed.

CAT|III

Rule-ID|SV-248549r958518_rule

STIG-ID|OL08-00-010171

Vuln-ID|V-248549

OL08-00-010190 - A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-248551r958524_rule

STIG-ID|OL08-00-010190

Vuln-ID|V-248551

OL08-00-010200 - OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.

800-53|AC-12

800-53|SC-10

CCI|CCI-001133

CCI|CCI-002361

Rule-ID|SV-248552r986329_rule

STIG-ID|OL08-00-010200

Vuln-ID|V-248552

OL08-00-010201 - OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.

Rule-ID|SV-248553r986330_rule

STIG-ID|OL08-00-010201

Vuln-ID|V-248553

OL08-00-010210 - The OL 8 '/var/log/messages' file must have mode 0640 or less permissive.

800-53|SI-11b.

CCI|CCI-001314

Rule-ID|SV-248554r958566_rule

STIG-ID|OL08-00-010210

Vuln-ID|V-248554

OL08-00-010220 - The OL 8 '/var/log/messages' file must be owned by root.

Rule-ID|SV-248555r958566_rule

STIG-ID|OL08-00-010220

Vuln-ID|V-248555

OL08-00-010230 - The OL 8 '/var/log/messages' file must be group-owned by root.

Rule-ID|SV-248556r958566_rule

STIG-ID|OL08-00-010230

Vuln-ID|V-248556

OL08-00-010240 - The OL 8 '/var/log' directory must have mode 0755 or less permissive.

Rule-ID|SV-248557r958566_rule

STIG-ID|OL08-00-010240

Vuln-ID|V-248557

OL08-00-010250 - The OL 8 '/var/log' directory must be owned by root.

Detections

Analytics

DISA Oracle Linux 8 STIG v2r1

Audit Details

File Details

Audit Changelog

Revision 1.4

Functional Update

Revision 1.3

Functional Update

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Functional Update


Revision 1.4 Oct 15, 2024 Functional Update OL08-00-010460 - There must be no 'shosts.equiv' files on the OL 8 operating system. OL08-00-010470 - There must be no '.shosts' files on the OL 8 operating system.
Revision 1.3 Oct 1, 2024 Functional Update OL08-00-040134 - OL 8 must mount '/var/tmp' with the 'noexec' option.
Revision 1.2 Sep 16, 2024 Functional Update OL08-00-010360 - The OL 8 file integrity tool must notify the System Administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency. Miscellaneous Variables updated.
Revision 1.1 Sep 10, 2024 Functional Update OL08-00-010019 - OL 8 must ensure cryptographic verification of vendor software packages.

Detections

Analytics

DISA Oracle Linux 8 STIG v2r1 Download File

Audit Details

File Details

Audit Changelog

Revision 1.4

Functional Update

Revision 1.3

Functional Update

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Functional Update

DISA Oracle Linux 8 STIG v2r1