DISA_Canonical_Ubuntu_20.04_LTS_STIG_v2r3.audit from DISA Canonical Ubuntu 20.04 LTS STIG v2r3

UBTU-20-010000 - The Ubuntu operating system must provision temporary user accounts with an expiration time of 72 hours or less.

800-53|AC-2(2)

CAT|II

CCI|CCI-000016

Rule-ID|SV-238196r958364_rule

STIG-ID|UBTU-20-010000

Vuln-ID|V-238196

UBTU-20-010002 - The Ubuntu operating system must enable the graphical user logon banner to display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-238197r958390_rule

STIG-ID|UBTU-20-010002

Vuln-ID|V-238197

UBTU-20-010003 - The Ubuntu operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.

Rule-ID|SV-238198r958390_rule

STIG-ID|UBTU-20-010003

Vuln-ID|V-238198

UBTU-20-010004 - The Ubuntu operating system must retain a user's session lock until that user reestablishes access using established identification and authentication procedures.

800-53|AC-11a.

800-53|AC-11b.

CCI|CCI-000056

CCI|CCI-000057

Rule-ID|SV-238199r958400_rule

STIG-ID|UBTU-20-010004

Vuln-ID|V-238199

UBTU-20-010005 - The Ubuntu operating system must allow users to directly initiate a session lock for all connection types.

800-53|AC-11(1)

CCI|CCI-000058

CCI|CCI-000060

Rule-ID|SV-238200r1015139_rule

STIG-ID|UBTU-20-010005

Vuln-ID|V-238200

UBTU-20-010006 - The Ubuntu operating system must map the authenticated identity to the user or group account for PKI-based authentication.

800-53|IA-5(2)(c)

CAT|I

CCI|CCI-000187

Rule-ID|SV-238201r958452_rule

STIG-ID|UBTU-20-010006

Vuln-ID|V-238201

UBTU-20-010007 - The Ubuntu operating system must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.

800-53|IA-5(1)(d)

CAT|III

CCI|CCI-000198

CCI|CCI-004066

Rule-ID|SV-238202r1015140_rule

STIG-ID|UBTU-20-010007

Vuln-ID|V-238202

UBTU-20-010008 - The Ubuntu operating system must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction.

CCI|CCI-000199

Rule-ID|SV-238203r1038967_rule

STIG-ID|UBTU-20-010008

Vuln-ID|V-238203

UBTU-20-010009 - Ubuntu operating systems when booted must require authentication upon booting into single-user and maintenance modes.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-238204r958472_rule

STIG-ID|UBTU-20-010009

Vuln-ID|V-238204

UBTU-20-010010 - The Ubuntu operating system must uniquely identify interactive users.

800-53|IA-2

800-53|IA-8

CCI|CCI-000764

CCI|CCI-000804

Rule-ID|SV-238205r958482_rule

STIG-ID|UBTU-20-010010

Vuln-ID|V-238205

UBTU-20-010012 - The Ubuntu operating system must ensure only users who need access to security functions are part of sudo group.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-238206r958518_rule

STIG-ID|UBTU-20-010012

Vuln-ID|V-238206

UBTU-20-010013 - The Ubuntu operating system must automatically terminate a user session after inactivity timeouts have expired.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-238207r1069086_rule

STIG-ID|UBTU-20-010013

Vuln-ID|V-238207

UBTU-20-010014 - The Ubuntu operating system must require users to reauthenticate for privilege escalation or when changing roles.

800-53|IA-11

CCI|CCI-002038

CCI|CCI-004895

Rule-ID|SV-238208r1101674_rule

STIG-ID|UBTU-20-010014

Vuln-ID|V-238208

UBTU-20-010015 - Ubuntu 20.04 LTS must require users to provide a password for privilege escalation.

Rule-ID|SV-274859r1101698_rule

STIG-ID|UBTU-20-010015

Vuln-ID|V-274859

UBTU-20-010016 - The Ubuntu operating system default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-238209r991590_rule

STIG-ID|UBTU-20-010016

Vuln-ID|V-238209

UBTU-20-010017 - Ubuntu 20.04 LTS must restrict privilege elevation to authorized personnel.

Rule-ID|SV-274858r1106125_rule

STIG-ID|UBTU-20-010017

Vuln-ID|V-274858

UBTU-20-010018 - Ubuntu 20.04 LTS must have the "SSSD" package installed.

800-53|IA-2(1)

800-53|IA-2(2)

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-004046

CCI|CCI-004047

Rule-ID|SV-274853r1106127_rule

STIG-ID|UBTU-20-010018

Vuln-ID|V-274853

UBTU-20-010019 - Ubuntu 20.04 LTS must use the "SSSD" package for multifactor authentication services.

Rule-ID|SV-274854r1106129_rule

STIG-ID|UBTU-20-010019

Vuln-ID|V-274854

UBTU-20-010020 - Ubuntu 20.04 LTS must ensure SSSD performs certificate path validation, including revocation checking, against a trusted anchor for PKI-based authentication.

800-53|IA-5(2)(a)

CCI|CCI-000185

CCI|CCI-004909

Rule-ID|SV-274855r1107182_rule

STIG-ID|UBTU-20-010020

Vuln-ID|V-274855

UBTU-20-010021 - Ubuntu 20.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.

800-53|IA-5(13)

CCI|CCI-002007

Rule-ID|SV-274856r1106132_rule

STIG-ID|UBTU-20-010021

Vuln-ID|V-274856

UBTU-20-010022 - Ubuntu 20.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

Rule-ID|SV-274857r1101692_rule

STIG-ID|UBTU-20-010022

Vuln-ID|V-274857

UBTU-20-010033 - The Ubuntu operating system must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.

800-53|IA-2(3)

800-53|IA-2(4)

CCI|CCI-000767

CCI|CCI-000768

Rule-ID|SV-238210r1015143_rule

STIG-ID|UBTU-20-010033

Vuln-ID|V-238210

UBTU-20-010035 - The Ubuntu operating system must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.

800-53|MA-4c.

CCI|CCI-000877

Rule-ID|SV-238211r958510_rule

STIG-ID|UBTU-20-010035

Vuln-ID|V-238211

UBTU-20-010036 - The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic after a period of inactivity.

800-53|SC-10

CCI|CCI-001133

Rule-ID|SV-238212r1015158_rule

STIG-ID|UBTU-20-010036

Vuln-ID|V-238212

UBTU-20-010037 - The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity.

Rule-ID|SV-238213r970703_rule

STIG-ID|UBTU-20-010037

Vuln-ID|V-238213

UBTU-20-010038 - The Ubuntu operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting any local or remote connection to the system.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-238214r958586_rule

STIG-ID|UBTU-20-010038

Vuln-ID|V-238214

UBTU-20-010042 - The Ubuntu operating system must use SSH to protect the confidentiality and integrity of transmitted information.

800-53|SC-8

800-53|SC-8(2)

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-238215r958908_rule

STIG-ID|UBTU-20-010042

Vuln-ID|V-238215

UBTU-20-010043 - The Ubuntu operating system must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

800-53|AC-17(2)

800-53|MA-4(6)

800-53|SC-8(1)

CCI|CCI-001453

CCI|CCI-002421

CCI|CCI-002890

Rule-ID|SV-238216r971547_rule

STIG-ID|UBTU-20-010043

Vuln-ID|V-238216

UBTU-20-010044 - The Ubuntu operating system must configure the SSH daemon to use FIPS 140-2 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

CCI|CCI-000068

CCI|CCI-003123

Rule-ID|SV-238217r971547_rule

STIG-ID|UBTU-20-010044

Vuln-ID|V-238217

UBTU-20-010045 - The Ubuntu operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.

Rule-ID|SV-255912r991554_rule

STIG-ID|UBTU-20-010045

Vuln-ID|V-255912

UBTU-20-010047 - The Ubuntu operating system must not allow unattended or automatic login via SSH.

Rule-ID|SV-238218r991591_rule

STIG-ID|UBTU-20-010047

Vuln-ID|V-238218

UBTU-20-010048 - The Ubuntu operating system must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements.

Detections

Analytics

DISA Canonical Ubuntu 20.04 LTS STIG v2r3

Audit Details

File Details

Audit Changelog

No revisions found