ALMA-09-001010 - AlmaLinux OS 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.

CAT|III

CCI|CCI-000054

Rule-ID|SV-269102r1049984_rule

STIG-ID|ALMA-09-001010

Vuln-ID|V-269102

ALMA-09-001120 - AlmaLinux OS 9 must automatically lock graphical user sessions after 15 minutes of inactivity.

CAT|II

CCI|CCI-000060

Rule-ID|SV-269103r1049985_rule

STIG-ID|ALMA-09-001120

Vuln-ID|V-269103

ALMA-09-001230 - AlmaLinux OS 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

Rule-ID|SV-269104r1049986_rule

STIG-ID|ALMA-09-001230

Vuln-ID|V-269104

ALMA-09-001340 - AlmaLinux OS 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.

Rule-ID|SV-269105r1049987_rule

STIG-ID|ALMA-09-001340

Vuln-ID|V-269105

ALMA-09-001450 - AlmaLinux OS 9 must initiate a session lock for graphical user interfaces when the screensaver is activated.

CCI|CCI-000057

Rule-ID|SV-269106r1049988_rule

STIG-ID|ALMA-09-001450

Vuln-ID|V-269106

ALMA-09-001560 - AlmaLinux OS 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.

Rule-ID|SV-269107r1049989_rule

STIG-ID|ALMA-09-001560

Vuln-ID|V-269107

ALMA-09-001890 - AlmaLinux OS 9 must automatically exit interactive command shell user sessions after 10 minutes of inactivity.

CCI|CCI-001133

CCI|CCI-002364

Rule-ID|SV-269108r1049990_rule

STIG-ID|ALMA-09-001890

Vuln-ID|V-269108

ALMA-09-002000 - AlmaLinux OS 9 must be able to directly initiate a session lock for all connection types using smart card when the smart card is removed.

CCI|CCI-000056

Rule-ID|SV-269109r1049991_rule

STIG-ID|ALMA-09-002000

Vuln-ID|V-269109

ALMA-09-002110 - AlmaLinux OS 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.

Rule-ID|SV-269110r1049992_rule

STIG-ID|ALMA-09-002110

Vuln-ID|V-269110

ALMA-09-002770 - AlmaLinux OS 9 must log SSH connection attempts and failures to the server.

CCI|CCI-000067

Rule-ID|SV-269111r1050605_rule

STIG-ID|ALMA-09-002770

Vuln-ID|V-269111

ALMA-09-002880 - All AlmaLinux OS 9 remote access methods must be monitored.

Rule-ID|SV-269112r1050606_rule

STIG-ID|ALMA-09-002880

Vuln-ID|V-269112

ALMA-09-002990 - AlmaLinux OS 9 SSH client must be configured to use only encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

CCI|CCI-001453

Rule-ID|SV-269113r1049995_rule

STIG-ID|ALMA-09-002990

Vuln-ID|V-269113

ALMA-09-003100 - AlmaLinux OS 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH client connections.

Rule-ID|SV-269114r1050607_rule

STIG-ID|ALMA-09-003100

Vuln-ID|V-269114

ALMA-09-003210 - AlmaLinux OS 9 SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.

Rule-ID|SV-269115r1050618_rule

STIG-ID|ALMA-09-003210

Vuln-ID|V-269115

ALMA-09-003320 - AlmaLinux OS 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH server connections.

Rule-ID|SV-269116r1050608_rule

STIG-ID|ALMA-09-003320

Vuln-ID|V-269116

ALMA-09-003325 - AlmaLinux OS 9 SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms.

Rule-ID|SV-269117r1049999_rule

STIG-ID|ALMA-09-003325

Vuln-ID|V-269117

ALMA-09-003430 - AlmaLinux OS 9 must implement DOD-approved systemwide cryptographic policies to protect the confidentiality of SSH server connections.

Rule-ID|SV-269118r1050609_rule

STIG-ID|ALMA-09-003430

Vuln-ID|V-269118

ALMA-09-003540 - AlmaLinux OS 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.

Rule-ID|SV-269119r1050001_rule

STIG-ID|ALMA-09-003540

Vuln-ID|V-269119

ALMA-09-003650 - AlmaLinux OS 9 must force a frequent session key renegotiation for SSH connections to the server.

CCI|CCI-000068

Rule-ID|SV-269120r1050610_rule

STIG-ID|ALMA-09-003650

Vuln-ID|V-269120

ALMA-09-003760 - AlmaLinux OS 9 must implement DOD-approved TLS encryption in the GnuTLS package.

CAT|I

Rule-ID|SV-269121r1050611_rule

STIG-ID|ALMA-09-003760

Vuln-ID|V-269121

ALMA-09-003870 - AlmaLinux OS 9 IP tunnels must use FIPS 140-3 approved cryptographic algorithms.

Rule-ID|SV-269122r1050004_rule

STIG-ID|ALMA-09-003870

Vuln-ID|V-269122

ALMA-09-003980 - AlmaLinux OS 9 must implement DOD-approved encryption in the OpenSSL package.

Rule-ID|SV-269123r1050005_rule

STIG-ID|ALMA-09-003980

Vuln-ID|V-269123

ALMA-09-004090 - AlmaLinux OS 9 must implement DOD-approved TLS encryption in the OpenSSL package.

Rule-ID|SV-269124r1050006_rule

STIG-ID|ALMA-09-004090

Vuln-ID|V-269124

ALMA-09-004310 - AlmaLinux OS 9 must use the TuxCare FIPS repository.

CCI|CCI-000877

CCI|CCI-002450

Rule-ID|SV-269125r1050007_rule

STIG-ID|ALMA-09-004310

Vuln-ID|V-269125

ALMA-09-004320 - AlmaLinux OS 9 must use the TuxCare FIPS packages and not the default encryption packages.

Rule-ID|SV-269126r1050008_rule

STIG-ID|ALMA-09-004320

Vuln-ID|V-269126

ALMA-09-004420 - AlmaLinux OS 9 must enable FIPS mode.

Rule-ID|SV-269127r1050612_rule

STIG-ID|ALMA-09-004420

Vuln-ID|V-269127

ALMA-09-004750 - AlmaLinux OS 9 must automatically expire temporary accounts within 72 hours.

CCI|CCI-000016

CCI|CCI-001682

Rule-ID|SV-269128r1050010_rule

STIG-ID|ALMA-09-004750

Vuln-ID|V-269128

ALMA-09-004970 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.

CCI|CCI-000015

CCI|CCI-000018

CCI|CCI-000130

CCI|CCI-000135

CCI|CCI-000169

CCI|CCI-000172

CCI|CCI-001403

CCI|CCI-001404

CCI|CCI-001405

CCI|CCI-002130

CCI|CCI-002884

CCI|CCI-004188

Rule-ID|SV-269129r1050011_rule

STIG-ID|ALMA-09-004970

Vuln-ID|V-269129

ALMA-09-005080 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

Rule-ID|SV-269130r1050012_rule

STIG-ID|ALMA-09-005080

Vuln-ID|V-269130

ALMA-09-005190 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.

Rule-ID|SV-269131r1050013_rule

STIG-ID|ALMA-09-005190

Vuln-ID|V-269131

ALMA-09-005300 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.

Rule-ID|SV-269132r1050014_rule

STIG-ID|ALMA-09-005300

Vuln-ID|V-269132

ALMA-09-005410 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

Rule-ID|SV-269133r1050015_rule

STIG-ID|ALMA-09-005410

Vuln-ID|V-269133

ALMA-09-005960 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

Rule-ID|SV-269134r1050016_rule

STIG-ID|ALMA-09-005960

Vuln-ID|V-269134

ALMA-09-006070 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/

Rule-ID|SV-269135r1050017_rule

STIG-ID|ALMA-09-006070

Vuln-ID|V-269135

ALMA-09-006180 - AlmaLinux OS 9 must require authentication to access emergency mode.

CCI|CCI-000213

Rule-ID|SV-269136r1050018_rule

STIG-ID|ALMA-09-006180

Vuln-ID|V-269136

ALMA-09-006290 - AlmaLinux OS 9 must require a boot loader password.

Rule-ID|SV-269137r1050019_rule

STIG-ID|ALMA-09-006290

Vuln-ID|V-269137

ALMA-09-006400 - AlmaLinux OS 9 must require a unique superuser's name upon booting into single-user and maintenance modes.

Rule-ID|SV-269138r1050020_rule

STIG-ID|ALMA-09-006400

Vuln-ID|V-269138

ALMA-09-006510 - AlmaLinux OS 9 must require authentication to access single-user mode.

Rule-ID|SV-269139r1050021_rule

STIG-ID|ALMA-09-006510

Vuln-ID|V-269139

ALMA-09-006620 - The systemd Ctrl-Alt-Delete burst key sequence in AlmaLinux OS 9 must be disabled.

CCI|CCI-002235

Rule-ID|SV-269140r1050022_rule

STIG-ID|ALMA-09-006620

Vuln-ID|V-269140

ALMA-09-006730 - The Ctrl-Alt-Delete key sequence must be disabled on AlmaLinux OS 9.

Rule-ID|SV-269141r1050023_rule

STIG-ID|ALMA-09-006730

Vuln-ID|V-269141

ALMA-09-006840 - AlmaLinux OS 9 must have the sudo package installed.

Rule-ID|SV-269142r1050024_rule

STIG-ID|ALMA-09-006840

Vuln-ID|V-269142

ALMA-09-006950 - The AlmaLinux OS 9 debug-shell systemd service must be disabled.

Rule-ID|SV-269143r1050025_rule

STIG-ID|ALMA-09-006950

Vuln-ID|V-269143

ALMA-09-007060 - AlmaLinux OS 9 must enable kernel parameters to enforce discretionary access control on hardlinks.

Detections

Analytics

DISA CloudLinux AlmaLinux OS 9 STIG v1r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Functional Update

Revision 1.1

Miscellaneous


Revision 1.3 Apr 29, 2025 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Apr 10, 2025 Functional Update ALMA-09-034340 - AlmaLinux OS 9 must use the CAC smart card driver.
Revision 1.1 Apr 2, 2025 Miscellaneous Metadata updated. See also link updated.