Revision 1.2Jul 14, 2026
Functional Update
- 1.3.1.3 Ensure all AppArmor Profiles are not disabled
Informational Update
- 1.1.1.1 Ensure cramfs kernel module is not available
- 1.4.2 Ensure access to bootloader config is configured
- 1.6.2 Ensure system wide crypto policy is not set to legacy
- 1.6.4 Ensure system wide crypto policy disables sha1 hash and signature support
- 1.6.5 Ensure system wide crypto policy disables macs less than 128 bits
- 1.6.6 Ensure system wide crypto policy disables cbc for ssh
- 1.6.7 Ensure system wide crypto policy disables chacha20-poly1305 for ssh
- 2.3.3.1 Ensure chrony is configured
- 2.4.2.1 Ensure access to at is configured
- 4.2.4 Ensure default zone is set
- 5.1.4 Ensure sshd Ciphers are configured
- 5.1.5 Ensure sshd KexAlgorithms is configured
- 5.1.6 Ensure sshd MACs are configured
- 5.1.7 Ensure sshd access is configured
- 5.1.9 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured
- 5.2.6 Ensure sudo authentication timeout is configured correctly
- 5.3.2.1.1 Ensure password failed attempts lockout is configured
- 5.3.2.1.2 Ensure password unlock time is configured
- 5.3.2.2.1 Ensure password dictionary check is enabled
- 5.3.2.2.3 Ensure password length is configured
- 5.3.2.2.4 Ensure password complexity is configured
- 5.3.2.2.5 Ensure password same consecutive characters is configured
- 5.3.2.2.6 Ensure password maximum sequential characters is configured
- 5.3.2.2.7 Ensure password quality is enforced for the root user
- 5.4.1.1 Ensure password expiration is configured
- 5.4.2.8 Ensure accounts without a valid login shell are locked
- 5.4.3.2 Ensure default user shell timeout is configured
- 5.4.3.3 Ensure default user umask is configured
- 6.1.1 Ensure AIDE is installed
- 6.1.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tools
- 7.1.11 Ensure world writable files and directories are secured
Miscellaneous
- Metadata updated.
- References updated.
