DISA_STIG_Canonical_Ubuntu_20.04_LTS_v2r4.audit from DISA Canonical Ubuntu 20.04 LTS STIG v2r4

UBTU-20-010000 - The Ubuntu operating system must provision temporary user accounts with an expiration time of 72 hours or less.

800-53|AC-2(2)

CAT|II

CCI|CCI-000016

Rule-ID|SV-238196r958364_rule

STIG-ID|UBTU-20-010000

Vuln-ID|V-238196

UBTU-20-010001 - Ubuntu 20.04 LTS must be a vendor-supported release.

800-53|CM-6b.

CAT|I

CCI|CCI-000366

Rule-ID|SV-278950r1135398_rule

STIG-ID|UBTU-20-010001

Vuln-ID|V-278950

UBTU-20-010002 - The Ubuntu operating system must enable the graphical user logon banner to display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-238197r958390_rule

STIG-ID|UBTU-20-010002

Vuln-ID|V-238197

UBTU-20-010003 - The Ubuntu operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.

Rule-ID|SV-238198r958390_rule

STIG-ID|UBTU-20-010003

Vuln-ID|V-238198

UBTU-20-010004 - The Ubuntu operating system must retain a user's session lock until that user reestablishes access using established identification and authentication procedures.

800-53|AC-11a.

800-53|AC-11b.

CCI|CCI-000056

CCI|CCI-000057

Rule-ID|SV-238199r958400_rule

STIG-ID|UBTU-20-010004

Vuln-ID|V-238199

UBTU-20-010005 - The Ubuntu operating system must allow users to directly initiate a session lock for all connection types.

800-53|AC-11(1)

CCI|CCI-000058

CCI|CCI-000060

Rule-ID|SV-238200r1015139_rule

STIG-ID|UBTU-20-010005

Vuln-ID|V-238200

UBTU-20-010006 - The Ubuntu operating system must map the authenticated identity to the user or group account for PKI-based authentication.

800-53|IA-5(2)(c)

CCI|CCI-000187

Rule-ID|SV-238201r958452_rule

STIG-ID|UBTU-20-010006

Vuln-ID|V-238201

UBTU-20-010007 - The Ubuntu operating system must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.

800-53|IA-5(1)(d)

CAT|III

CCI|CCI-000198

CCI|CCI-004066

Rule-ID|SV-238202r1015140_rule

STIG-ID|UBTU-20-010007

Vuln-ID|V-238202

UBTU-20-010008 - The Ubuntu operating system must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction.

CCI|CCI-000199

Rule-ID|SV-238203r1038967_rule

STIG-ID|UBTU-20-010008

Vuln-ID|V-238203

UBTU-20-010009 - Ubuntu operating systems when booted must require authentication upon booting into single-user and maintenance modes.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-238204r1117265_rule

STIG-ID|UBTU-20-010009

Vuln-ID|V-238204

UBTU-20-010010 - The Ubuntu operating system must uniquely identify interactive users.

800-53|IA-2

800-53|IA-8

CCI|CCI-000764

CCI|CCI-000804

Rule-ID|SV-238205r958482_rule

STIG-ID|UBTU-20-010010

Vuln-ID|V-238205

UBTU-20-010012 - The Ubuntu operating system must ensure only users who need access to security functions are part of sudo group.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-238206r958518_rule

STIG-ID|UBTU-20-010012

Vuln-ID|V-238206

UBTU-20-010013 - The Ubuntu operating system must automatically terminate a user session after inactivity timeouts have expired.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-238207r1069086_rule

STIG-ID|UBTU-20-010013

Vuln-ID|V-238207

UBTU-20-010014 - The Ubuntu operating system must require users to reauthenticate for privilege escalation or when changing roles.

800-53|IA-11

CCI|CCI-002038

CCI|CCI-004895

Rule-ID|SV-238208r1101674_rule

STIG-ID|UBTU-20-010014

Vuln-ID|V-238208

UBTU-20-010015 - Ubuntu 20.04 LTS must require users to provide a password for privilege escalation.

Rule-ID|SV-274859r1101698_rule

STIG-ID|UBTU-20-010015

Vuln-ID|V-274859

UBTU-20-010016 - The Ubuntu operating system default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files.

Rule-ID|SV-238209r991590_rule

STIG-ID|UBTU-20-010016

Vuln-ID|V-238209

UBTU-20-010017 - Ubuntu 20.04 LTS must restrict privilege elevation to authorized personnel.

Rule-ID|SV-274858r1106125_rule

STIG-ID|UBTU-20-010017

Vuln-ID|V-274858

UBTU-20-010018 - Ubuntu 20.04 LTS must have the "SSSD" package installed.

800-53|IA-2(1)

800-53|IA-2(2)

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-004046

CCI|CCI-004047

Rule-ID|SV-274853r1106127_rule

STIG-ID|UBTU-20-010018

Vuln-ID|V-274853

UBTU-20-010019 - Ubuntu 20.04 LTS must use the "SSSD" package for multifactor authentication services.

Rule-ID|SV-274854r1106129_rule

STIG-ID|UBTU-20-010019

Vuln-ID|V-274854

UBTU-20-010020 - Ubuntu 20.04 LTS must ensure SSSD performs certificate path validation, including revocation checking, against a trusted anchor for PKI-based authentication.

800-53|IA-5(2)(a)

CCI|CCI-000185

CCI|CCI-004909

Rule-ID|SV-274855r1107182_rule

STIG-ID|UBTU-20-010020

Vuln-ID|V-274855

UBTU-20-010021 - Ubuntu 20.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.

800-53|IA-5(13)

CCI|CCI-002007

Rule-ID|SV-274856r1106132_rule

STIG-ID|UBTU-20-010021

Vuln-ID|V-274856

UBTU-20-010022 - Ubuntu 20.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

Rule-ID|SV-274857r1101692_rule

STIG-ID|UBTU-20-010022

Vuln-ID|V-274857

UBTU-20-010033 - The Ubuntu operating system must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.

800-53|IA-2(3)

800-53|IA-2(4)

CCI|CCI-000767

CCI|CCI-000768

Rule-ID|SV-238210r1015143_rule

STIG-ID|UBTU-20-010033

Vuln-ID|V-238210

UBTU-20-010035 - The Ubuntu operating system must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.

800-53|MA-4c.

CCI|CCI-000877

Rule-ID|SV-238211r958510_rule

STIG-ID|UBTU-20-010035

Vuln-ID|V-238211

UBTU-20-010036 - The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic after a period of inactivity.

800-53|SC-10

CCI|CCI-001133

Rule-ID|SV-238212r1015158_rule

STIG-ID|UBTU-20-010036

Vuln-ID|V-238212

UBTU-20-010037 - The Ubuntu operating system must immediately terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity.

Rule-ID|SV-238213r970703_rule

STIG-ID|UBTU-20-010037

Vuln-ID|V-238213

UBTU-20-010038 - The Ubuntu operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting any local or remote connection to the system.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-238214r958586_rule

STIG-ID|UBTU-20-010038

Vuln-ID|V-238214

UBTU-20-010042 - The Ubuntu operating system must use SSH to protect the confidentiality and integrity of transmitted information.

800-53|SC-8

800-53|SC-8(2)

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-238215r958908_rule

STIG-ID|UBTU-20-010042

Vuln-ID|V-238215

UBTU-20-010043 - The Ubuntu operating system must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

800-53|AC-17(2)

800-53|MA-4(6)

800-53|SC-8(1)

CCI|CCI-001453

CCI|CCI-002421

CCI|CCI-002890

Rule-ID|SV-238216r1117271_rule

STIG-ID|UBTU-20-010043

Vuln-ID|V-238216

UBTU-20-010044 - The Ubuntu operating system must configure the SSH daemon to use FIPS 140-2 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

CCI|CCI-000068

CCI|CCI-003123

Rule-ID|SV-238217r1117271_rule

STIG-ID|UBTU-20-010044

Vuln-ID|V-238217

UBTU-20-010045 - The Ubuntu operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.

Rule-ID|SV-255912r991554_rule

STIG-ID|UBTU-20-010045

Vuln-ID|V-255912

UBTU-20-010047 - The Ubuntu operating system must not allow unattended or automatic login via SSH.

Detections

Analytics

DISA Canonical Ubuntu 20.04 LTS STIG v2r4

Audit Details

File Details

Audit Changelog

No revisions found