1.1.1.6 Ensure squashfs kernel module is not available

800-53|CM-6

800-53|CM-7

CSCv7|9.2

1.1.1.7 Ensure udf kernel module is not available

1.1.2.3.1 Ensure separate partition exists for /home

800-53|AC-3

800-53|AC-5

800-53|AC-6

800-53|MP-2

CSCv7|14.6

1.1.2.4.1 Ensure separate partition exists for /var

1.1.2.5.1 Ensure separate partition exists for /var/tmp

1.1.2.6.1 Ensure separate partition exists for /var/log

800-53|AU-4

CSCv7|6.4

1.1.2.7.1 Ensure separate partition exists for /var/log/audit

1.2.1.3 Ensure repo_gpgcheck is globally activated

800-53|RA-5

800-53|SI-2

800-53|SI-2(2)

CSCv7|3.4

1.3.1.5 Ensure the SELinux mode is enforcing

800-53|AC-3(4)

800-53|SI-6a.

1.3.1.6 Ensure no unconfined services exist

1.8.1 Ensure GNOME Display Manager is removed

2.1.20 Ensure X window server services are not in use

800-53|CM-11

2.2.2 Ensure ldap client is not installed

CSCv7|2.6

3.2.1 Ensure dccp kernel module is not available

800-53|SI-4

3.2.2 Ensure tipc kernel module is not available

3.2.3 Ensure rds kernel module is not available

3.2.4 Ensure sctp kernel module is not available

5.1.10 Ensure sshd DisableForwarding is enabled

5.1.11 Ensure sshd GSSAPIAuthentication is disabled

800-53|CM-1

800-53|CM-2

800-53|IA-5

800-53|IA-5(1)

CSCv7|4.4

5.2.4 Ensure users must provide password for escalation

800-53|AC-6(2)

800-53|AC-6(5)

CSCv7|4.3

5.3.3.1.3 Ensure password failed attempts lockout includes root account

800-53|AC-1

800-53|AC-2

800-53|AC-2(1)

CSCv7|16.7

5.4.1.2 Ensure minimum password days is configured

5.4.3.1 Ensure nologin is not listed in /etc/shells

6.3.1.1 Ensure auditd packages are installed

800-53|AU-2

800-53|AU-3

800-53|AU-3(1)

800-53|AU-7

800-53|AU-12

800-53|SI-5

CSCv7|6.2

CSCv7|6.3

6.3.1.2 Ensure auditing for processes that start prior to auditd is enabled

6.3.1.3 Ensure audit_backlog_limit is sufficient

6.3.1.4 Ensure auditd service is enabled and active

6.3.2.1 Ensure audit log storage size is configured

800-53|AU-8

6.3.2.2 Ensure audit logs are not automatically deleted

6.3.2.3 Ensure system is disabled when audit logs are full

6.3.2.4 Ensure system warns when audit logs are low on space

6.3.3.1 Ensure changes to system administration scope (sudoers) is collected

CSCv7|4.8

6.3.3.2 Ensure actions as another user are always logged

CSCv7|4.9

6.3.3.3 Ensure events that modify the sudo log file are collected

6.3.3.4 Ensure events that modify date and time information are collected

CSCv7|5.5

6.3.3.5 Ensure events that modify the system's network environment are collected

6.3.3.6 Ensure use of privileged commands are collected

6.3.3.7 Ensure unsuccessful file access attempts are collected

CSCv7|14.9

6.3.3.8 Ensure events that modify user/group information are collected

6.3.3.9 Ensure discretionary access control permission modification events are collected

6.3.3.10 Ensure successful file system mounts are collected

6.3.3.11 Ensure session initiation information is collected

CSCv7|16.13

6.3.3.12 Ensure login and logout events are collected

CSCv7|16.11

6.3.3.13 Ensure file deletion events by users are collected

800-53|SC-7

6.3.3.14 Ensure events that modify the system's Mandatory Access Controls are collected

6.3.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected

6.3.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected

6.3.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected

6.3.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected

6.3.3.19 Ensure kernel module loading unloading and modification is collected

6.3.3.20 Ensure the audit configuration is immutable

6.3.3.21 Ensure the running and on disk configuration is the same

6.3.4.1 Ensure the audit log file directory mode is configured

6.3.4.2 Ensure audit log files mode is configured

6.3.4.3 Ensure audit log files owner is configured

6.3.4.4 Ensure audit log files group owner is configured

6.3.4.5 Ensure audit configuration files mode is configured

6.3.4.6 Ensure audit configuration files owner is configured

6.3.4.7 Ensure audit configuration files group owner is configured

6.3.4.8 Ensure audit tools mode is configured

6.3.4.9 Ensure audit tools owner is configured

6.3.4.10 Ensure audit tools group owner is configured

CIS_AlmaLinux_OS_9_v2.0.0_L2_Server.audit from CIS AlmaLinux OS 9 v2.0.0

Detections

Analytics

Revision 1.4Dec 29, 2025

Miscellaneous

Added

Removed