DISA_STIG_Red_Hat_Enterprise_Linux_9_v2r2.audit from DISA Red Hat Enterprise Linux 9 v2r2 STIG

RHEL-09-211010 - RHEL 9 must be a vendor-supported release.

800-53|CM-6b.

CAT|I

CCI|CCI-000366

Rule-ID|SV-257777r991589_rule

STIG-ID|RHEL-09-211010

Vuln-ID|V-257777

RHEL-09-211015 - RHEL 9 vendor packaged system security patches and updates must be installed and up to date.

CAT|II

Rule-ID|SV-257778r991589_rule

STIG-ID|RHEL-09-211015

Vuln-ID|V-257778

RHEL-09-211020 - RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

800-53|AC-8a.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-000048

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-257779r958390_rule

STIG-ID|RHEL-09-211020

Vuln-ID|V-257779

RHEL-09-211030 - The graphical display manager must not be the default target on RHEL 9 unless approved.

Rule-ID|SV-257781r991589_rule

STIG-ID|RHEL-09-211030

Vuln-ID|V-257781

RHEL-09-211035 - RHEL 9 must enable the hardware random number generator entropy gatherer service.

CAT|III

Rule-ID|SV-257782r991589_rule

STIG-ID|RHEL-09-211035

Vuln-ID|V-257782

RHEL-09-211040 - RHEL 9 systemd-journald service must be enabled.

800-53|SC-24

CCI|CCI-001665

Rule-ID|SV-257783r991562_rule

STIG-ID|RHEL-09-211040

Vuln-ID|V-257783

RHEL-09-211045 - The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-257784r958726_rule

STIG-ID|RHEL-09-211045

Vuln-ID|V-257784

RHEL-09-211050 - The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.

Rule-ID|SV-257785r958726_rule

STIG-ID|RHEL-09-211050

Vuln-ID|V-257785

RHEL-09-211055 - RHEL 9 debug-shell systemd service must be disabled.

Rule-ID|SV-257786r958726_rule

STIG-ID|RHEL-09-211055

Vuln-ID|V-257786

RHEL-09-212010 - RHEL 9 must require a boot loader superuser password.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-257787r958472_rule

STIG-ID|RHEL-09-212010

Vuln-ID|V-257787

RHEL-09-212015 - RHEL 9 must disable the ability of systemd to spawn an interactive boot process.

Rule-ID|SV-257788r991589_rule

STIG-ID|RHEL-09-212015

Vuln-ID|V-257788

RHEL-09-212020 - RHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes.

Rule-ID|SV-257789r1014822_rule

STIG-ID|RHEL-09-212020

Vuln-ID|V-257789

RHEL-09-212025 - RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root.

Rule-ID|SV-257790r991589_rule

STIG-ID|RHEL-09-212025

Vuln-ID|V-257790

RHEL-09-212030 - RHEL 9 /boot/grub2/grub.cfg file must be owned by root.

Rule-ID|SV-257791r991589_rule

STIG-ID|RHEL-09-212030

Vuln-ID|V-257791

RHEL-09-212035 - RHEL 9 must disable virtual system calls.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-257792r991589_rule

STIG-ID|RHEL-09-212035

Vuln-ID|V-257792

RHEL-09-212040 - RHEL 9 must clear the page allocator to prevent use-after-free attacks.

Rule-ID|SV-257793r991589_rule

STIG-ID|RHEL-09-212040

Vuln-ID|V-257793

RHEL-09-212045 - RHEL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.

800-53|SI-16

CCI|CCI-002824

Rule-ID|SV-257794r958928_rule

STIG-ID|RHEL-09-212045

Vuln-ID|V-257794

RHEL-09-212050 - RHEL 9 must enable mitigations against processor-based vulnerabilities.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-257795r958928_rule

STIG-ID|RHEL-09-212050

Vuln-ID|V-257795

RHEL-09-212055 - RHEL 9 must enable auditing of processes that start prior to the audit daemon.

800-53|AU-3

800-53|AU-3(1)

800-53|AU-12a.

800-53|AU-12c.

800-53|AU-14(1)

800-53|MA-4(1)(a)

CCI|CCI-000130

CCI|CCI-000135

CCI|CCI-000169

CCI|CCI-000172

CCI|CCI-001464

CCI|CCI-002884

Rule-ID|SV-257796r958412_rule

STIG-ID|RHEL-09-212055

Vuln-ID|V-257796

RHEL-09-213010 - RHEL 9 must restrict access to the kernel message buffer.

800-53|SC-2

800-53|SC-4

CCI|CCI-001082

CCI|CCI-001090

Rule-ID|SV-257797r958514_rule

STIG-ID|RHEL-09-213010

Vuln-ID|V-257797

RHEL-09-213015 - RHEL 9 must prevent kernel profiling by nonprivileged users.

Rule-ID|SV-257798r958514_rule

STIG-ID|RHEL-09-213015

Vuln-ID|V-257798

RHEL-09-213020 - RHEL 9 must prevent the loading of a new kernel for later execution.

800-53|CM-5(3)

CCI|CCI-001749

CCI|CCI-003992

Rule-ID|SV-257799r1015074_rule

STIG-ID|RHEL-09-213020

Vuln-ID|V-257799

RHEL-09-213025 - RHEL 9 must restrict exposed kernel pointer addresses access.

Rule-ID|SV-257800r958514_rule

STIG-ID|RHEL-09-213025

Vuln-ID|V-257800

RHEL-09-213030 - RHEL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.

800-53|AC-3(4)

CCI|CCI-002165

Rule-ID|SV-257801r958702_rule

STIG-ID|RHEL-09-213030

Vuln-ID|V-257801

RHEL-09-213035 - RHEL 9 must enable kernel parameters to enforce discretionary access control on symlinks.

Rule-ID|SV-257802r958702_rule

STIG-ID|RHEL-09-213035

Vuln-ID|V-257802

RHEL-09-213040 - RHEL 9 must disable the kernel.core_pattern.

Rule-ID|SV-257803r991589_rule

STIG-ID|RHEL-09-213040

Vuln-ID|V-257803

RHEL-09-213045 - RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module.

Rule-ID|SV-257804r958478_rule

STIG-ID|RHEL-09-213045

Vuln-ID|V-257804

RHEL-09-213050 - RHEL 9 must be configured to disable the Controller Area Network kernel module.

Rule-ID|SV-257805r958478_rule

STIG-ID|RHEL-09-213050

Vuln-ID|V-257805

RHEL-09-213055 - RHEL 9 must be configured to disable the FireWire kernel module.

Rule-ID|SV-257806r958478_rule

STIG-ID|RHEL-09-213055

Vuln-ID|V-257806

RHEL-09-213060 - RHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.

Rule-ID|SV-257807r958478_rule

STIG-ID|RHEL-09-213060

Vuln-ID|V-257807

RHEL-09-213065 - RHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.

Rule-ID|SV-257808r958478_rule

STIG-ID|RHEL-09-213065

Vuln-ID|V-257808

RHEL-09-213070 - RHEL 9 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution.

Rule-ID|SV-257809r958928_rule

STIG-ID|RHEL-09-213070

Vuln-ID|V-257809

RHEL-09-213075 - RHEL 9 must disable access to network bpf system call from nonprivileged processes.

Rule-ID|SV-257810r958514_rule

STIG-ID|RHEL-09-213075

Vuln-ID|V-257810

RHEL-09-213080 - RHEL 9 must restrict usage of ptrace to descendant processes.

Rule-ID|SV-257811r958514_rule

STIG-ID|RHEL-09-213080

Vuln-ID|V-257811

RHEL-09-213085 - RHEL 9 must disable core dump backtraces.

Rule-ID|SV-257812r991589_rule

STIG-ID|RHEL-09-213085

Vuln-ID|V-257812

RHEL-09-213090 - RHEL 9 must disable storing core dumps.

Rule-ID|SV-257813r991589_rule

STIG-ID|RHEL-09-213090

Vuln-ID|V-257813

RHEL-09-213095 - RHEL 9 must disable core dumps for all users.

Rule-ID|SV-257814r991589_rule

STIG-ID|RHEL-09-213095

Vuln-ID|V-257814

RHEL-09-213100 - RHEL 9 must disable acquiring, saving, and processing core dumps.

Rule-ID|SV-257815r991589_rule

STIG-ID|RHEL-09-213100

Vuln-ID|V-257815

Detections

Analytics

Revision 1.1

Dec 3, 2024

Functional Update

Miscellaneous