DISA_Canonical_Ubuntu_24.04_LTS_STIG_v1r1.audit from DISA Canonical Ubuntu 24.04 LTS STIG v1r1

UBTU-24-90890 - Ubuntu 24.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools.

CAT|II

CCI|CCI-001496

Rule-ID|SV-270831r1066982_rule

STIG-ID|UBTU-24-90890

Vuln-ID|V-270831

UBTU-24-100010 - Ubuntu 24.04 LTS must not have the "systemd-timesyncd" package installed.

CAT|III

CCI|CCI-000366

Rule-ID|SV-270645r1068357_rule

STIG-ID|UBTU-24-100010

Vuln-ID|V-270645

UBTU-24-100020 - Ubuntu 24.04 LTS must not have the "ntp" package installed.

Rule-ID|SV-270646r1068358_rule

STIG-ID|UBTU-24-100020

Vuln-ID|V-270646

UBTU-24-100030 - Ubuntu 24.04 LTS must not have the telnet package installed.

CAT|I

CCI|CCI-000197

Rule-ID|SV-270647r1066430_rule

STIG-ID|UBTU-24-100030

Vuln-ID|V-270647

UBTU-24-100040 - Ubuntu 24.04 LTS must not have the rsh-server package installed.

CCI|CCI-000381

Rule-ID|SV-270648r1066433_rule

STIG-ID|UBTU-24-100040

Vuln-ID|V-270648

UBTU-24-100100 - Ubuntu 24.04 LTS must use a file integrity tool to verify correct operation of all security functions.

CCI|CCI-002696

Rule-ID|SV-270649r1067136_rule

STIG-ID|UBTU-24-100100

Vuln-ID|V-270649

UBTU-24-100110 - Ubuntu 24.04 LTS must configure AIDE to preform file integrity checking on the file system.

Rule-ID|SV-270650r1066439_rule

STIG-ID|UBTU-24-100110

Vuln-ID|V-270650

UBTU-24-100120 - Ubuntu 24.04 LTS must be configured so that the script which runs each 30 days or less to check file integrity is the default one.

CCI|CCI-002699

Rule-ID|SV-270651r1068395_rule

STIG-ID|UBTU-24-100120

Vuln-ID|V-270651

UBTU-24-100130 - Ubuntu 24.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.

CCI|CCI-001744

CCI|CCI-002702

Rule-ID|SV-270652r1067138_rule

STIG-ID|UBTU-24-100130

Vuln-ID|V-270652

UBTU-24-100200 - Ubuntu 24.04 LTS must be configured to preserve log records from failure events.

CCI|CCI-001665

Rule-ID|SV-270653r1067141_rule

STIG-ID|UBTU-24-100200

Vuln-ID|V-270653

UBTU-24-100300 - Ubuntu 24.04 LTS must have an application firewall installed in order to control remote access methods.

CCI|CCI-002314

Rule-ID|SV-270654r1067143_rule

STIG-ID|UBTU-24-100300

Vuln-ID|V-270654

UBTU-24-100310 - Ubuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw).

Rule-ID|SV-270655r1067145_rule

STIG-ID|UBTU-24-100310

Vuln-ID|V-270655

UBTU-24-100400 - Ubuntu 24.04 LTS must have the "auditd" package installed.

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000154

CCI|CCI-000158

CCI|CCI-000169

CCI|CCI-000172

CCI|CCI-001875

CCI|CCI-001876

CCI|CCI-001877

CCI|CCI-001878

CCI|CCI-001879

CCI|CCI-001880

CCI|CCI-001881

CCI|CCI-001882

CCI|CCI-001914

CCI|CCI-003938

Rule-ID|SV-270656r1067148_rule

STIG-ID|UBTU-24-100400

Vuln-ID|V-270656

UBTU-24-100410 - Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.

Rule-ID|SV-270657r1066460_rule

STIG-ID|UBTU-24-100410

Vuln-ID|V-270657

UBTU-24-100450 - Ubuntu 24.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system or storage media from the system being audited.

CCI|CCI-001851

Rule-ID|SV-270658r1067151_rule

STIG-ID|UBTU-24-100450

Vuln-ID|V-270658

UBTU-24-100500 - Ubuntu 24.04 LTS must have AppArmor installed.

CCI|CCI-001764

CCI|CCI-001774

CCI|CCI-002165

Rule-ID|SV-270659r1066466_rule

STIG-ID|UBTU-24-100500

Vuln-ID|V-270659

UBTU-24-100510 - Ubuntu 24.04 LTS must be configured to use AppArmor.

CCI|CCI-002235

Rule-ID|SV-270660r1066469_rule

STIG-ID|UBTU-24-100510

Vuln-ID|V-270660

UBTU-24-100600 - Ubuntu 24.04 LTS must have the "libpam-pwquality" package installed.

Rule-ID|SV-270661r1067175_rule

STIG-ID|UBTU-24-100600

Vuln-ID|V-270661

UBTU-24-100650 - Ubuntu 24.04 LTS must have the "SSSD" package installed.

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-004046

CCI|CCI-004047

Rule-ID|SV-270662r1067156_rule

STIG-ID|UBTU-24-100650

Vuln-ID|V-270662

UBTU-24-100660 - Ubuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services.

Rule-ID|SV-270663r1066478_rule

STIG-ID|UBTU-24-100660

Vuln-ID|V-270663

UBTU-24-100700 - Ubuntu 24.04 LTS must have the "chrony" package installed.

Rule-ID|SV-270664r1068359_rule

STIG-ID|UBTU-24-100700

Vuln-ID|V-270664

UBTU-24-100800 - Ubuntu 24.04 LTS must have SSH installed.

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-270665r1067133_rule

STIG-ID|UBTU-24-100800

Vuln-ID|V-270665

UBTU-24-100810 - Ubuntu 24.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.

Rule-ID|SV-270666r1066487_rule

STIG-ID|UBTU-24-100810

Vuln-ID|V-270666

UBTU-24-100820 - Ubuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

CCI|CCI-000068

CCI|CCI-002421

CCI|CCI-003123

Rule-ID|SV-270667r1067107_rule

STIG-ID|UBTU-24-100820

Vuln-ID|V-270667

UBTU-24-100830 - Ubuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

CCI|CCI-001453

CCI|CCI-002890

Rule-ID|SV-270668r1067110_rule

STIG-ID|UBTU-24-100830

Vuln-ID|V-270668

UBTU-24-100840 - Ubuntu 24.04 LTS SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms.

Rule-ID|SV-270669r1067112_rule

STIG-ID|UBTU-24-100840

Vuln-ID|V-270669

UBTU-24-100850 - Ubuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.

Rule-ID|SV-270670r1067115_rule

STIG-ID|UBTU-24-100850

Vuln-ID|V-270670

UBTU-24-100860 - Ubuntu 24.04 LTS SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.

Rule-ID|SV-270671r1067118_rule

STIG-ID|UBTU-24-100860

Vuln-ID|V-270671

UBTU-24-100900 - Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials.

CCI|CCI-001953

Rule-ID|SV-270672r1067161_rule

STIG-ID|UBTU-24-100900

Vuln-ID|V-270672

UBTU-24-100910 - Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials managed through the Privileged Access Management (PAM)  framework.

Rule-ID|SV-270673r1067164_rule

STIG-ID|UBTU-24-100910

Vuln-ID|V-270673

UBTU-24-101000 - Ubuntu 24.04 LTS must allow users to directly initiate a session lock for all connection types.

CCI|CCI-000057

CCI|CCI-000060

Rule-ID|SV-270674r1067167_rule

STIG-ID|UBTU-24-101000

Vuln-ID|V-270674

UBTU-24-102000 - Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes.

CCI|CCI-000213

Rule-ID|SV-270675r1066514_rule

STIG-ID|UBTU-24-102000

Vuln-ID|V-270675

UBTU-24-102010 - Ubuntu 24.04 LTS must initiate session audits at system startup.

CCI|CCI-001464

Rule-ID|SV-270676r1068360_rule

STIG-ID|UBTU-24-102010

Vuln-ID|V-270676

UBTU-24-200000 - Ubuntu 24.04 LTS must limit the number of concurrent sessions to 10 for all accounts and/or account types.

CCI|CCI-000054

Rule-ID|SV-270677r1066520_rule

STIG-ID|UBTU-24-200000

Vuln-ID|V-270677

UBTU-24-200020 - Ubuntu 24.04 LTS must initiate a graphical session lock after 10 minutes of inactivity.

Rule-ID|SV-270678r1066523_rule

STIG-ID|UBTU-24-200020

Vuln-ID|V-270678

UBTU-24-200040 - Ubuntu 24.04 LTS must retain a user's session lock until the user reestablishes access using established identification and authentication procedures.

CCI|CCI-000056

Rule-ID|SV-270679r1066526_rule

STIG-ID|UBTU-24-200040

Detections

Analytics

DISA Canonical Ubuntu 24.04 LTS STIG v1r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Sep 19, 2025 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Sep 12, 2025 Miscellaneous Metadata updated.