DISA_Canonical_Ubuntu_20.04_LTS_STIG_v2r3.audit from DISA Canonical Ubuntu 20.04 LTS STIG v2r3

UBTU-20-010000 - The Ubuntu operating system must provision temporary user accounts with an expiration time of 72 hours or less.

CAT|II

CCI|CCI-000016

Rule-ID|SV-238196r958364_rule

STIG-ID|UBTU-20-010000

Vuln-ID|V-238196

UBTU-20-010002 - The Ubuntu operating system must enable the graphical user logon banner to display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon.

CCI|CCI-000048

Rule-ID|SV-238197r958390_rule

STIG-ID|UBTU-20-010002

Vuln-ID|V-238197

UBTU-20-010003 - The Ubuntu operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.

Rule-ID|SV-238198r958390_rule

STIG-ID|UBTU-20-010003

Vuln-ID|V-238198

UBTU-20-010004 - The Ubuntu operating system must retain a user's session lock until that user reestablishes access using established identification and authentication procedures.

CCI|CCI-000056

CCI|CCI-000057

Rule-ID|SV-238199r958400_rule

STIG-ID|UBTU-20-010004

Vuln-ID|V-238199

UBTU-20-010005 - The Ubuntu operating system must allow users to directly initiate a session lock for all connection types.

CCI|CCI-000058

CCI|CCI-000060

Rule-ID|SV-238200r1015139_rule

STIG-ID|UBTU-20-010005

Vuln-ID|V-238200

UBTU-20-010006 - The Ubuntu operating system must map the authenticated identity to the user or group account for PKI-based authentication.

CAT|I

CCI|CCI-000187

Rule-ID|SV-238201r958452_rule

STIG-ID|UBTU-20-010006

Vuln-ID|V-238201

UBTU-20-010007 - The Ubuntu operating system must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.

CAT|III

CCI|CCI-000198

CCI|CCI-004066

Rule-ID|SV-238202r1015140_rule

STIG-ID|UBTU-20-010007

Vuln-ID|V-238202

UBTU-20-010008 - The Ubuntu operating system must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction.

CCI|CCI-000199

Rule-ID|SV-238203r1038967_rule

STIG-ID|UBTU-20-010008

Vuln-ID|V-238203

UBTU-20-010009 - Ubuntu operating systems when booted must require authentication upon booting into single-user and maintenance modes.

CCI|CCI-000213

Rule-ID|SV-238204r958472_rule

STIG-ID|UBTU-20-010009

Vuln-ID|V-238204

UBTU-20-010010 - The Ubuntu operating system must uniquely identify interactive users.

CCI|CCI-000764

CCI|CCI-000804

Rule-ID|SV-238205r958482_rule

STIG-ID|UBTU-20-010010

Vuln-ID|V-238205

UBTU-20-010012 - The Ubuntu operating system must ensure only users who need access to security functions are part of sudo group.

CCI|CCI-001084

Rule-ID|SV-238206r958518_rule

STIG-ID|UBTU-20-010012

Vuln-ID|V-238206

UBTU-20-010013 - The Ubuntu operating system must automatically terminate a user session after inactivity timeouts have expired.

CCI|CCI-002361

Rule-ID|SV-238207r1069086_rule

STIG-ID|UBTU-20-010013

Vuln-ID|V-238207

UBTU-20-010014 - The Ubuntu operating system must require users to reauthenticate for privilege escalation or when changing roles.

CCI|CCI-002038

CCI|CCI-004895

Rule-ID|SV-238208r1101674_rule

STIG-ID|UBTU-20-010014

Vuln-ID|V-238208

UBTU-20-010015 - Ubuntu 20.04 LTS must require users to provide a password for privilege escalation.

Rule-ID|SV-274859r1101698_rule

STIG-ID|UBTU-20-010015

Vuln-ID|V-274859

UBTU-20-010016 - The Ubuntu operating system default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files.

CCI|CCI-000366

Rule-ID|SV-238209r991590_rule

STIG-ID|UBTU-20-010016

Vuln-ID|V-238209

UBTU-20-010017 - Ubuntu 20.04 LTS must restrict privilege elevation to authorized personnel.

Rule-ID|SV-274858r1106125_rule

STIG-ID|UBTU-20-010017

Vuln-ID|V-274858

UBTU-20-010018 - Ubuntu 20.04 LTS must have the "SSSD" package installed.

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-004046

CCI|CCI-004047

Rule-ID|SV-274853r1106127_rule

STIG-ID|UBTU-20-010018

Vuln-ID|V-274853

UBTU-20-010019 - Ubuntu 20.04 LTS must use the "SSSD" package for multifactor authentication services.

Rule-ID|SV-274854r1106129_rule

STIG-ID|UBTU-20-010019

Vuln-ID|V-274854

UBTU-20-010020 - Ubuntu 20.04 LTS must ensure SSSD performs certificate path validation, including revocation checking, against a trusted anchor for PKI-based authentication.

CCI|CCI-000185

CCI|CCI-004909

Rule-ID|SV-274855r1107182_rule

STIG-ID|UBTU-20-010020

Vuln-ID|V-274855

UBTU-20-010021 - Ubuntu 20.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.

CCI|CCI-002007

Rule-ID|SV-274856r1106132_rule

STIG-ID|UBTU-20-010021

Vuln-ID|V-274856

UBTU-20-010022 - Ubuntu 20.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

Rule-ID|SV-274857r1101692_rule

STIG-ID|UBTU-20-010022

Vuln-ID|V-274857

UBTU-20-010033 - The Ubuntu operating system must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.

CCI|CCI-000767

CCI|CCI-000768

Rule-ID|SV-238210r1015143_rule

STIG-ID|UBTU-20-010033

Vuln-ID|V-238210

UBTU-20-010035 - The Ubuntu operating system must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.

CCI|CCI-000877

Rule-ID|SV-238211r958510_rule

STIG-ID|UBTU-20-010035

Vuln-ID|V-238211

UBTU-20-010036 - The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic after a period of inactivity.

CCI|CCI-001133

Rule-ID|SV-238212r1015158_rule

STIG-ID|UBTU-20-010036

Vuln-ID|V-238212

UBTU-20-010037 - The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity.

Rule-ID|SV-238213r970703_rule

STIG-ID|UBTU-20-010037

Vuln-ID|V-238213

UBTU-20-010038 - The Ubuntu operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting any local or remote connection to the system.

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-238214r958586_rule

STIG-ID|UBTU-20-010038

Vuln-ID|V-238214

UBTU-20-010042 - The Ubuntu operating system must use SSH to protect the confidentiality and integrity of transmitted information.

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-238215r958908_rule

STIG-ID|UBTU-20-010042

Vuln-ID|V-238215

UBTU-20-010043 - The Ubuntu operating system must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

CCI|CCI-001453

CCI|CCI-002421

CCI|CCI-002890

Rule-ID|SV-238216r971547_rule

STIG-ID|UBTU-20-010043

Vuln-ID|V-238216

UBTU-20-010044 - The Ubuntu operating system must configure the SSH daemon to use FIPS 140-2 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

CCI|CCI-000068

CCI|CCI-003123

Rule-ID|SV-238217r971547_rule

STIG-ID|UBTU-20-010044

Vuln-ID|V-238217

UBTU-20-010045 - The Ubuntu operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.

Rule-ID|SV-255912r991554_rule

STIG-ID|UBTU-20-010045

Vuln-ID|V-255912

UBTU-20-010047 - The Ubuntu operating system must not allow unattended or automatic login via SSH.

Rule-ID|SV-238218r991591_rule

STIG-ID|UBTU-20-010047

Vuln-ID|V-238218

UBTU-20-010048 - The Ubuntu operating system must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements.

Rule-ID|SV-238219r991589_rule

STIG-ID|UBTU-20-010048

Vuln-ID|V-238219

UBTU-20-010049 - The Ubuntu operating system SSH daemon must prevent remote hosts from connecting to the proxy display.

Rule-ID|SV-238220r991589_rule

STIG-ID|UBTU-20-010049

Vuln-ID|V-238220

UBTU-20-010050 - The Ubuntu operating system must enforce password complexity by requiring that at least one upper-case character be used.

CCI|CCI-000192

Rule-ID|SV-238221r1015144_rule

STIG-ID|UBTU-20-010050

Vuln-ID|V-238221

UBTU-20-010051 - The Ubuntu operating system must enforce password complexity by requiring that at least one lower-case character be used.

CCI|CCI-000193

Rule-ID|SV-238222r1015145_rule

STIG-ID|UBTU-20-010051

Vuln-ID|V-238222

UBTU-20-010052 - The Ubuntu operating system must enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-238223r1015146_rule

STIG-ID|UBTU-20-010052

Vuln-ID|V-238223

UBTU-20-010053 - The Ubuntu operating system must require the change of at least 8 characters when passwords are changed.

CCI|CCI-000195

Rule-ID|SV-238224r1015147_rule

STIG-ID|UBTU-20-010053

Vuln-ID|V-238224

UBTU-20-010054 - The Ubuntu operating system must enforce a minimum 15-character password length.

CCI|CCI-000205

Rule-ID|SV-238225r1015148_rule

Detections

Analytics

DISA Canonical Ubuntu 20.04 LTS STIG v2r3

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous