DISA_Oracle_Linux_8_STIG_v2r4.audit from DISA Oracle Linux 8 STIG v2r4

OL08-00-010000 - OL 8 must be a vendor-supported release.

800-53|CM-6b.

CAT|I

CCI|CCI-000366

Rule-ID|SV-248521r991589_rule

STIG-ID|OL08-00-010000

Vuln-ID|V-248521

OL08-00-010010 - OL 8 vendor-packaged system security patches and updates must be installed and up to date.

CAT|II

Rule-ID|SV-248523r991589_rule

STIG-ID|OL08-00-010010

Vuln-ID|V-248523

OL08-00-010019 - OL 8 must ensure cryptographic verification of vendor software packages.

800-53|CM-5(3)

CCI|CCI-001749

CCI|CCI-003992

Rule-ID|SV-256978r1015073_rule

STIG-ID|OL08-00-010019

Vuln-ID|V-256978

OL08-00-010020 - OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

800-53|AC-17(2)

800-53|MA-4(6)

800-53|MA-4c.

800-53|SC-8

CCI|CCI-000068

CCI|CCI-000877

CCI|CCI-001453

CCI|CCI-002418

CCI|CCI-002890

CCI|CCI-003123

Rule-ID|SV-248524r1069154_rule

STIG-ID|OL08-00-010020

Vuln-ID|V-248524

OL08-00-010030 - All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.

800-53|SC-28

800-53|SC-28(1)

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-248525r1016496_rule

STIG-ID|OL08-00-010030

Vuln-ID|V-248525

OL08-00-010040 - OL 8 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via an SSH logon.

800-53|AC-8a.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-000048

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-248526r958390_rule

STIG-ID|OL08-00-010040

Vuln-ID|V-248526

OL08-00-010049 - OL 8 must display a banner before granting local or remote access to the system via a graphical user logon.

Rule-ID|SV-248527r958390_rule

STIG-ID|OL08-00-010049

Vuln-ID|V-248527

OL08-00-010050 - OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

Rule-ID|SV-248528r958390_rule

STIG-ID|OL08-00-010050

Vuln-ID|V-248528

OL08-00-010060 - OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

Rule-ID|SV-248529r958390_rule

STIG-ID|OL08-00-010060

Vuln-ID|V-248529

OL08-00-010070 - All OL 8 remote access methods must be monitored.

800-53|AC-17(1)

CCI|CCI-000067

Rule-ID|SV-248530r958406_rule

STIG-ID|OL08-00-010070

Vuln-ID|V-248530

OL08-00-010090 - OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

800-53|IA-5(2)(a)

800-53|IA-5(2)(d)

CCI|CCI-000185

CCI|CCI-001991

CCI|CCI-004068

Rule-ID|SV-248531r1015027_rule

STIG-ID|OL08-00-010090

Vuln-ID|V-248531

OL08-00-010100 - OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-248532r958450_rule

STIG-ID|OL08-00-010100

Vuln-ID|V-248532

OL08-00-010110 - OL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.

800-53|IA-5(1)(c)

CCI|CCI-000196

CCI|CCI-004062

Rule-ID|SV-248533r1015028_rule

STIG-ID|OL08-00-010110

Vuln-ID|V-248533

OL08-00-010120 - OL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.

Rule-ID|SV-248534r1015029_rule

STIG-ID|OL08-00-010120

Vuln-ID|V-248534

OL08-00-010121 - The OL 8 operating system must not have accounts configured with blank or null passwords.

Rule-ID|SV-252650r991589_rule

STIG-ID|OL08-00-010121

Vuln-ID|V-252650

OL08-00-010130 - The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.

Rule-ID|SV-248535r1044786_rule

STIG-ID|OL08-00-010130

Vuln-ID|V-248535

OL08-00-010140 - OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-248537r958472_rule

STIG-ID|OL08-00-010140

Vuln-ID|V-248537

OL08-00-010141 - OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance.

Rule-ID|SV-248538r958472_rule

STIG-ID|OL08-00-010141

Vuln-ID|V-248538

OL08-00-010149 - OL 8 operating systems booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.

Rule-ID|SV-248539r958472_rule

STIG-ID|OL08-00-010149

Vuln-ID|V-248539

OL08-00-010150 - OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.

Rule-ID|SV-248540r958472_rule

STIG-ID|OL08-00-010150

Vuln-ID|V-248540

OL08-00-010151 - OL 8 operating systems must require authentication upon booting into rescue mode.

Rule-ID|SV-248541r958472_rule

STIG-ID|OL08-00-010151

Vuln-ID|V-248541

OL08-00-010152 - OL 8 operating systems must require authentication upon booting into emergency mode.

Rule-ID|SV-248542r958472_rule

STIG-ID|OL08-00-010152

Vuln-ID|V-248542

OL08-00-010159 - The OL 8 "pam_unix.so" module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-248543r971535_rule

STIG-ID|OL08-00-010159

Vuln-ID|V-248543

OL08-00-010160 - The OL 8 "pam_unix.so" module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

Rule-ID|SV-248544r971535_rule

STIG-ID|OL08-00-010160

Vuln-ID|V-248544

OL08-00-010161 - OL 8 must prevent system daemons from using Kerberos for authentication.

Rule-ID|SV-248545r971535_rule

STIG-ID|OL08-00-010161

Vuln-ID|V-248545

OL08-00-010162 - The krb5-workstation package must not be installed on OL 8.

Rule-ID|SV-248546r971535_rule

STIG-ID|OL08-00-010162

Vuln-ID|V-248546

OL08-00-010163 - The krb5-server package must not be installed on OL 8.

Rule-ID|SV-248547r971535_rule

STIG-ID|OL08-00-010163

Vuln-ID|V-248547

OL08-00-010170 - OL 8 must use a Linux Security Module configured to enforce limits on system services.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-248548r958518_rule

STIG-ID|OL08-00-010170

Vuln-ID|V-248548

OL08-00-010171 - OL 8 must have the "policycoreutils" package installed.

CAT|III

Rule-ID|SV-248549r958518_rule

STIG-ID|OL08-00-010171

Vuln-ID|V-248549

OL08-00-010190 - A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-248551r958524_rule

STIG-ID|OL08-00-010190

Vuln-ID|V-248551

OL08-00-010200 - OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.

800-53|AC-12

800-53|SC-10

CCI|CCI-001133

CCI|CCI-002361

Rule-ID|SV-248552r986329_rule

STIG-ID|OL08-00-010200

Vuln-ID|V-248552

OL08-00-010201 - OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.

Rule-ID|SV-248553r986330_rule

STIG-ID|OL08-00-010201

Vuln-ID|V-248553

OL08-00-010210 - The OL 8 "/var/log/messages" file must have mode 0640 or less permissive.

800-53|SI-11b.

CCI|CCI-001314

Rule-ID|SV-248554r958566_rule

STIG-ID|OL08-00-010210

Vuln-ID|V-248554

OL08-00-010220 - The OL 8 "/var/log/messages" file must be owned by root.

Rule-ID|SV-248555r958566_rule

STIG-ID|OL08-00-010220

Vuln-ID|V-248555

OL08-00-010230 - The OL 8 "/var/log/messages" file must be group-owned by root.

Rule-ID|SV-248556r958566_rule

STIG-ID|OL08-00-010230

Vuln-ID|V-248556

OL08-00-010240 - The OL 8 "/var/log" directory must have mode 0755 or less permissive.

Detections

Analytics

Revision 1.2Jul 22, 2025

Functional Update

Miscellaneous