Detections
Analytics

800-53|CM-3f.

Title

CONFIGURATION CHANGE CONTROL

Description

Audits and reviews activities associated with configuration-controlled changes to the information system; and

Reference Item Details

Category: CONFIGURATION MANAGEMENT

Family: CONFIGURATION MANAGEMENT

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.4.4 Ensure boot loader does not allow removable mediaUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
1.6.1.10 Ensure system device files are labeled - device_tUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
1.6.1.10 Ensure system device files are labeled - unlabeled_tUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
2.2.21 Ensure the TFTP server has not been installed - TFTP server package installed if not required for operational support.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.2.2.6 Ensure rsyslog imudp and imrelp aren't loaded.UnixCIS Amazon Linux 2 STIG v1.0.0 L3
5.3.30 Ensure SSH does not permit GSSAPI - GSSAPI authentication unless needed.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
5.3.31 Ensure SSH does not permit Kerberos authenticationUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
5.5.9 Ensure local interactive user accounts umask is 077UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
GEN002260 - The system must be checked for extraneous device files at least weekly.UnixDISA STIG for Red Hat Enterprise Linux 5 v1r18 Audit
GEN002260 - The system must be checked for extraneous device files at least weekly.UnixDISA STIG AIX 6.1 v1r14
GEN002260 - The system must be checked for extraneous device files at least weekly.UnixDISA STIG AIX 5.3 v1r2
GEN002260 - The system must be checked for extraneous device files at least weekly.UnixDISA STIG for Oracle Linux 5 v2r1
GEN002300 - Device files used for backup must only be readable and/or writable by root or the backup user.UnixDISA STIG for Red Hat Enterprise Linux 5 v1r18 Audit
GEN002400 - The system must be checked weekly for unauthorized setuid files and unauthorized modification to authorized setuid files.UnixDISA STIG AIX 6.1 v1r14
GEN002400 - The system must be checked weekly for unauthorized setuid files as well as unauthorized modification to authorized setuid files.UnixDISA STIG for Oracle Linux 5 v2r1
GEN002400 - The system must be checked weekly for unauthorized setuid files as well as unauthorized modification to setuid files.UnixDISA STIG for Red Hat Enterprise Linux 5 v1r18 Audit
GEN002400 - The system must be checked weekly for unauthorized setuid files, and unauthorized modification to authorized setuid files.UnixDISA STIG AIX 5.3 v1r2
GEN002460 - The system must be checked weekly for unauthorized setgid files and unauthorized modification to authorized setgid files.UnixDISA STIG AIX 6.1 v1r14
GEN002460 - The system must be checked weekly for unauthorized setgid files as well as unauthorized modification to authorized setgid files.UnixDISA STIG for Oracle Linux 5 v2r1
GEN002460 - The system must be checked weekly for unauthorized setgid files, and unauthorized modification to authorized setgid files.UnixDISA STIG AIX 5.3 v1r2
GEN002460 - The system must be checked weekly for unauthorized sgid files as well as unauthorized modification to authorized setgid files.UnixDISA STIG for Red Hat Enterprise Linux 5 v1r18 Audit
RHEL-07-020900 - The Red Hat Enterprise Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification.UnixDISA Red Hat Enterprise Linux 7 STIG v3r15
RHEL-07-021040 - The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive user accounts.UnixDISA Red Hat Enterprise Linux 7 STIG v3r15
RHEL-07-021700 - The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader unless approved.UnixDISA Red Hat Enterprise Linux 7 STIG v3r15
RHEL-07-031010 - The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.UnixDISA Red Hat Enterprise Linux 7 STIG v3r15
RHEL-07-040430 - The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.UnixDISA Red Hat Enterprise Linux 7 STIG v3r15
RHEL-07-040440 - The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.UnixDISA Red Hat Enterprise Linux 7 STIG v3r15
RHEL-07-040700 - The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.UnixDISA Red Hat Enterprise Linux 7 STIG v3r15
UBTU-16-030720 - The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for operational support.UnixDISA STIG Ubuntu 16.04 LTS v2r3