1.1.5 Ensure separate partition exists for /var

800-53|CM-1

800-53|CM-2

800-53|CM-6

800-53|CM-7

800-53|CM-7(1)

800-53|CM-9

800-53|SA-3

800-53|SA-8

800-53|SA-10

CSCv6|13

CSCv7|5.1

1.1.6 Ensure separate partition exists for /var/tmp

1.1.10 Ensure separate partition exists for /var/log

800-53|AU-4

CSCv6|6.3

CSCv7|6.4

1.1.11 Ensure separate partition exists for /var/log/audit

1.1.12 Ensure separate partition exists for /home

1.6.1.1 Ensure SELinux is not disabled in bootloader configuration - enforcing = 0

800-53|AC-3

800-53|AC-5

800-53|AC-6

800-53|MP-2

CSCv6|14.4

CSCv7|14.6

1.6.1.1 Ensure SELinux is not disabled in bootloader configuration - selinux = 0

1.6.1.2 Ensure the SELinux state is enforcing - /etc/selinux/config

1.6.1.2 Ensure the SELinux state is enforcing - sestatus

1.6.1.3 Ensure SELinux policy is configured

1.6.1.4 Ensure no unconfined daemons exist

1.6.2.1 Ensure AppArmor is enabled in the bootloader configuration - apparmor=1

1.6.2.1 Ensure AppArmor is enabled in the bootloader configuration - security=apparmor

1.6.2.2 Ensure all AppArmor Profiles are enforcing - 0 processes are unconfined

1.6.2.2 Ensure all AppArmor Profiles are enforcing - complain mode

1.6.2.2 Ensure all AppArmor Profiles are enforcing - profiles loaded

1.6.3 Ensure SELinux or AppArmor are installed

4.1.1.1 Ensure audit log storage size is configured

4.1.1.2 Ensure system is disabled when audit logs are full - action_mail_acct

4.1.1.2 Ensure system is disabled when audit logs are full - admin_space_left_action

4.1.1.2 Ensure system is disabled when audit logs are full - space_left_action

4.1.1.3 Ensure audit logs are not automatically deleted

800-53|AU-1

800-53|AU-2

CSCv6|6.2

CSCv7|6.2

CSCv7|6.3

4.1.3 Ensure auditing for processes that start prior to auditd is enabled

4.1.4 Ensure events that modify date and time information are collected - /etc/localtime

800-53|AU-3

800-53|AU-3(1)

800-53|AU-7

800-53|AU-12

CSCv6|3.6

CSCv7|5.5

4.1.4 Ensure events that modify date and time information are collected - adjtimex settimeofday stime

4.1.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime

4.1.4 Ensure events that modify date and time information are collected - auditctl adjtimex

4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime

4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime x64

4.1.4 Ensure events that modify date and time information are collected - auditctl settimeofday,adjtimex x64

4.1.4 Ensure events that modify date and time information are collected - clock_settime

4.1.4 Ensure events that modify date and time information are collected - clock_settime x64

4.1.4 Ensure events that modify date and time information are collected - settimeofday,adjtimex x64

4.1.5 Ensure events that modify user/group information are collected - /etc/group

CSCv6|5.4

CSCv7|4.8

4.1.5 Ensure events that modify user/group information are collected - /etc/gshadow

4.1.5 Ensure events that modify user/group information are collected - /etc/passwd

4.1.5 Ensure events that modify user/group information are collected - /etc/security/opasswd

4.1.5 Ensure events that modify user/group information are collected - /etc/shadow

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/group

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/gshadow

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/passwd

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/shadow

4.1.6 Ensure events that modify the system's network environment are collected - /etc/hosts

4.1.6 Ensure events that modify the system's network environment are collected - /etc/issue

4.1.6 Ensure events that modify the system's network environment are collected - /etc/network

4.1.6 Ensure events that modify the system's network environment are collected - auditctl '/etc/hosts'

4.1.6 Ensure events that modify the system's network environment are collected - auditctl '/etc/issue'

4.1.6 Ensure events that modify the system's network environment are collected - auditctl '/etc/network'

4.1.6 Ensure events that modify the system's network environment are collected - auditctl 'issue.net'

4.1.6 Ensure events that modify the system's network environment are collected - auditctl 'sethostname setdomainname'

4.1.6 Ensure events that modify the system's network environment are collected - auditctl 'sethostname setdomainname' x64

4.1.6 Ensure events that modify the system's network environment are collected - issue.net

4.1.6 Ensure events that modify the system's network environment are collected - sethostname setdomainname

4.1.6 Ensure events that modify the system's network environment are collected - sethostname setdomainname x64

4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor

4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor.d

4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/selinux

4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /usr/share/selinux/

4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/apparmor

4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/apparmor.d

4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/selinux

4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /usr/share/selinux

4.1.8 Ensure login and logout events are collected - auditctl faillog

CSCv6|5.5

CSCv6|16.4

CSCv6|16.10

CSCv7|4.9

CSCv7|16.11

CSCv7|16.13

4.1.8 Ensure login and logout events are collected - auditctl lastlog

4.1.8 Ensure login and logout events are collected - auditctl tallylog

4.1.8 Ensure login and logout events are collected - faillog

4.1.8 Ensure login and logout events are collected - lastlog

4.1.8 Ensure login and logout events are collected - tallylog

4.1.9 Ensure session initiation information is collected - /var/log/btmp

4.1.9 Ensure session initiation information is collected - /var/log/wtmp

4.1.9 Ensure session initiation information is collected - /var/run/utmp

4.1.9 Ensure session initiation information is collected - auditctl /var/log/btmp

4.1.9 Ensure session initiation information is collected - auditctl /var/log/wtmp

4.1.9 Ensure session initiation information is collected - auditctl /var/run/utmp

4.1.10 Ensure discretionary access control permission modification events are collected - auditctl chmod fchmod fchmodat

4.1.10 Ensure discretionary access control permission modification events are collected - auditctl chmod fchmod fchmodat x64

4.1.10 Ensure discretionary access control permission modification events are collected - auditctl chown fchown fchownat lchown

4.1.10 Ensure discretionary access control permission modification events are collected - auditctl chown fchown fchownat lchown x64

4.1.10 Ensure discretionary access control permission modification events are collected - auditctl lsetxattr setxattr fsetxattr removexattr

4.1.10 Ensure discretionary access control permission modification events are collected - auditctl setxattr x64

4.1.10 Ensure discretionary access control permission modification events are collected - chmod fchmod fchmodat

4.1.10 Ensure discretionary access control permission modification events are collected - chmod fchmod fchmodat x64

4.1.10 Ensure discretionary access control permission modification events are collected - chown fchown fchownat lchown

4.1.10 Ensure discretionary access control permission modification events are collected - chown fchown fchownat lchown x64

4.1.10 Ensure discretionary access control permission modification events are collected - lsetxattr setxattr fsetxattr removexattr

4.1.10 Ensure discretionary access control permission modification events are collected - lsetxattr setxattr fsetxattr removexattr x64

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES

CSCv6|14.6

CSCv7|14.9

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES x64

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM x64

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EACCES

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EACCES x64

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EPERM

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EPERM x64

4.1.12 Ensure use of privileged commands is collected

CSCv6|5.1

4.1.13 Ensure successful file system mounts are collected - auditctl mount

4.1.13 Ensure successful file system mounts are collected - auditctl mount x64

4.1.13 Ensure successful file system mounts are collected - mounts

Detections

Analytics

Revision 1.3

Jul 27, 2022

Functional Update

Miscellaneous