DISA_STIG_Oracle_Linux_8_v2r8.audit from DISA Oracle Linux 8 STIG v2r8

OL08-00-010000 - OL 8 must be a vendor-supported release.

800-53|CM-6b.

CAT|I

CCI|CCI-000366

Rule-ID|SV-248521r1156679_rule

STIG-ID|OL08-00-010000

Vuln-ID|V-248521

OL08-00-010010 - OL 8 vendor-packaged system security patches and updates must be installed and up to date.

CAT|II

Rule-ID|SV-248523r1184109_rule

STIG-ID|OL08-00-010010

Vuln-ID|V-248523

OL08-00-010019 - OL 8 must ensure cryptographic verification of vendor software packages.

800-53|CM-5(3)

CCI|CCI-001749

CCI|CCI-003992

Rule-ID|SV-256978r1015073_rule

STIG-ID|OL08-00-010019

Vuln-ID|V-256978

OL08-00-010020 - OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

800-53|AC-17(2)

800-53|MA-4(6)

800-53|MA-4c.

800-53|SC-8

CCI|CCI-000068

CCI|CCI-000877

CCI|CCI-001453

CCI|CCI-002418

CCI|CCI-002890

CCI|CCI-003123

Rule-ID|SV-248524r1069154_rule

STIG-ID|OL08-00-010020

Vuln-ID|V-248524

OL08-00-010030 - All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.

800-53|SC-28

800-53|SC-28(1)

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-248525r1016496_rule

STIG-ID|OL08-00-010030

Vuln-ID|V-248525

OL08-00-010040 - OL 8 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system via an SSH logon.

800-53|AC-8a.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-000048

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-248526r958390_rule

STIG-ID|OL08-00-010040

Vuln-ID|V-248526

OL08-00-010049 - OL 8 must display a banner before granting local or remote access to the system via a graphical user logon.

Rule-ID|SV-248527r958390_rule

STIG-ID|OL08-00-010049

Vuln-ID|V-248527

OL08-00-010050 - OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

Rule-ID|SV-248528r958390_rule

STIG-ID|OL08-00-010050

Vuln-ID|V-248528

OL08-00-010060 - OL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

Rule-ID|SV-248529r958390_rule

STIG-ID|OL08-00-010060

Vuln-ID|V-248529

OL08-00-010070 - All OL 8 remote access methods must be monitored.

800-53|AC-17(1)

CCI|CCI-000067

Rule-ID|SV-248530r958406_rule

STIG-ID|OL08-00-010070

Vuln-ID|V-248530

OL08-00-010090 - OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

800-53|IA-5(2)(a)

800-53|IA-5(2)(d)

CCI|CCI-000185

CCI|CCI-001991

CCI|CCI-004068

Rule-ID|SV-248531r1015027_rule

STIG-ID|OL08-00-010090

Vuln-ID|V-248531

OL08-00-010100 - OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-248532r958450_rule

STIG-ID|OL08-00-010100

Vuln-ID|V-248532

OL08-00-010110 - OL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.

800-53|IA-5(1)(c)

CCI|CCI-000196

CCI|CCI-004062

Rule-ID|SV-248533r1015028_rule

STIG-ID|OL08-00-010110

Vuln-ID|V-248533

OL08-00-010120 - OL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.

Rule-ID|SV-248534r1015029_rule

STIG-ID|OL08-00-010120

Vuln-ID|V-248534

OL08-00-010121 - The OL 8 operating system must not have accounts configured with blank or null passwords.

Rule-ID|SV-252650r991589_rule

STIG-ID|OL08-00-010121

Vuln-ID|V-252650

OL08-00-010130 - The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds.

Rule-ID|SV-248535r1044786_rule

STIG-ID|OL08-00-010130

Vuln-ID|V-248535

OL08-00-010140 - OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-248537r1137691_rule

STIG-ID|OL08-00-010140

Vuln-ID|V-248537

OL08-00-010141 - OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance.

Rule-ID|SV-248538r1137691_rule

STIG-ID|OL08-00-010141

Vuln-ID|V-248538

OL08-00-010149 - OL 8 operating systems booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.

Rule-ID|SV-248539r1137691_rule

STIG-ID|OL08-00-010149

Vuln-ID|V-248539

OL08-00-010150 - OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.

Rule-ID|SV-248540r1137691_rule

STIG-ID|OL08-00-010150

Vuln-ID|V-248540

OL08-00-010151 - OL 8 operating systems must require authentication upon booting into rescue mode.

Rule-ID|SV-248541r1137691_rule

STIG-ID|OL08-00-010151

Vuln-ID|V-248541

OL08-00-010152 - OL 8 operating systems must require authentication upon booting into emergency mode.

Rule-ID|SV-248542r1137691_rule

STIG-ID|OL08-00-010152

Vuln-ID|V-248542

OL08-00-010159 - The OL 8 "pam_unix.so" module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-248543r971535_rule

STIG-ID|OL08-00-010159

Vuln-ID|V-248543

OL08-00-010160 - The OL 8 "pam_unix.so" module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

Rule-ID|SV-248544r971535_rule

STIG-ID|OL08-00-010160

Vuln-ID|V-248544

OL08-00-010161 - OL 8 must prevent system daemons from using Kerberos for authentication.

Rule-ID|SV-248545r971535_rule

STIG-ID|OL08-00-010161

Vuln-ID|V-248545

OL08-00-010162 - The krb5-workstation package must not be installed on OL 8.

Rule-ID|SV-248546r971535_rule

STIG-ID|OL08-00-010162

Vuln-ID|V-248546

OL08-00-010163 - The krb5-server package must not be installed on OL 8.

Rule-ID|SV-248547r971535_rule

STIG-ID|OL08-00-010163

Vuln-ID|V-248547

OL08-00-010170 - OL 8 must use a Linux Security Module configured to enforce limits on system services.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-248548r958518_rule

STIG-ID|OL08-00-010170

Vuln-ID|V-248548

OL08-00-010171 - OL 8 must have the "policycoreutils" package installed.

CAT|III

Rule-ID|SV-248549r958518_rule

STIG-ID|OL08-00-010171

Vuln-ID|V-248549

OL08-00-010180 - OL 8 must have the crypto-policies package installed.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-283444r1188528_rule

STIG-ID|OL08-00-010180

Vuln-ID|V-283444

OL08-00-010181 - OL 8 must implement a FIPS 140-3-compliant systemwide cryptographic policy.

Rule-ID|SV-283445r1188529_rule

STIG-ID|OL08-00-010181

Vuln-ID|V-283445

OL08-00-010182 - OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Rule-ID|SV-283446r1188530_rule

STIG-ID|OL08-00-010182

Vuln-ID|V-283446

OL08-00-010183 - OL 8 cryptographic policy must not be overridden.

Rule-ID|SV-283447r1188533_rule

STIG-ID|OL08-00-010183

Vuln-ID|V-283447

OL08-00-010184 - The OL 8 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Rule-ID|SV-283448r1188536_rule

STIG-ID|OL08-00-010184

Vuln-ID|V-283448

OL08-00-010185 - The OL 8 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.

Rule-ID|SV-283449r1188539_rule

STIG-ID|OL08-00-010185

Vuln-ID|V-283449

OL08-00-010186 - OL 8 IP tunnels must use FIPS 140-3-approved cryptographic algorithms.

Rule-ID|SV-283450r1188541_rule

STIG-ID|OL08-00-010186

Vuln-ID|V-283450

OL08-00-010187 - OL 8 must implement DOD-approved encryption in the bind package.

800-53|SC-8(2)

CCI|CCI-002422

Detections

Analytics

DISA Oracle Linux 8 STIG v2r8

Audit Details

File Details

Audit Changelog

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Jul 14, 2026 Functional Update OL08-00-010770 - All OL 8 local initialization files must have mode \"0740\" or less permissive. Miscellaneous Metadata updated.
Revision 1.1 Jun 2, 2026 Miscellaneous Metadata updated.

Detections

Analytics

DISA Oracle Linux 8 STIG v2r8 Download File

Audit Details

File Details

Audit Changelog

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Miscellaneous

DISA Oracle Linux 8 STIG v2r8