DISA_STIG_Ubuntu_18.04_LTS_v2r7.audit from DISA Canonical Ubuntu 18.04 LTS v2r7 STIG

UBTU-18-010000 - Ubuntu operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes.

CAT|I

CCI|CCI-000213

Rule-ID|SV-219147r802349_rule

STIG-ID|UBTU-18-010000

STIG-Legacy|SV-109623

STIG-Legacy|V-100519

Vuln-ID|V-219147

UBTU-18-010001 - Ubuntu operating systems booted with United Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance.

Rule-ID|SV-219148r808471_rule

STIG-ID|UBTU-18-010001

STIG-Legacy|SV-109625

STIG-Legacy|V-100521

Vuln-ID|V-219148

UBTU-18-010002 - The Ubuntu operating system must initiate session audits at system startup.

CAT|II

CCI|CCI-001464

Rule-ID|SV-219149r610963_rule

STIG-ID|UBTU-18-010002

STIG-Legacy|SV-109627

STIG-Legacy|V-100523

Vuln-ID|V-219149

UBTU-18-010003 - Ubuntu operating systems handling data requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-219150r610963_rule

STIG-ID|UBTU-18-010003

STIG-Legacy|SV-109629

STIG-Legacy|V-100525

Vuln-ID|V-219150

UBTU-18-010005 - The Ubuntu operating system must implement NIST FIPS-validated cryptography to protect classified information and for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

CCI|CCI-002450

Rule-ID|SV-219151r610963_rule

STIG-ID|UBTU-18-010005

STIG-Legacy|SV-109631

STIG-Legacy|V-100527

Vuln-ID|V-219151

UBTU-18-010006 - The Ubuntu operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity - action_mail_acct

CAT|III

CCI|CCI-001855

Rule-ID|SV-219152r610963_rule

STIG-ID|UBTU-18-010006

STIG-Legacy|SV-109633

STIG-Legacy|V-100529

Vuln-ID|V-219152

UBTU-18-010006 - The Ubuntu operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity - space_left

UBTU-18-010006 - The Ubuntu operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity - space_left_action

UBTU-18-010006 - The Ubuntu operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity - space_left_action syslog

UBTU-18-010007 - The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system in real time, if the system is interconnected - active=yes

CCI|CCI-001851

Rule-ID|SV-219153r610963_rule

STIG-ID|UBTU-18-010007

STIG-Legacy|SV-109635

STIG-Legacy|V-100531

Vuln-ID|V-219153

UBTU-18-010007 - The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system in real time, if the system is interconnected - installed

UBTU-18-010007 - The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system in real time, if the system is interconnected - remote_server

UBTU-18-010008 - The Ubuntu operating system must have a crontab script running weekly to off-load audit events of standalone systems.

Rule-ID|SV-219154r610963_rule

STIG-ID|UBTU-18-010008

STIG-Legacy|SV-109637

STIG-Legacy|V-100533

Vuln-ID|V-219154

UBTU-18-010016 - Advance package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

CCI|CCI-001749

Rule-ID|SV-219155r610963_rule

STIG-ID|UBTU-18-010016

STIG-Legacy|SV-109639

STIG-Legacy|V-100535

Vuln-ID|V-219155

UBTU-18-010017 - The Ubuntu operating system must be configured so that Advance package Tool (APT) removes all software components after updated versions have been installed - Remove-Unused-Dependencies

CCI|CCI-002617

Rule-ID|SV-219156r610963_rule

STIG-ID|UBTU-18-010017

STIG-Legacy|SV-109641

STIG-Legacy|V-100537

Vuln-ID|V-219156

UBTU-18-010017 - The Ubuntu operating system must be configured so that Advance package Tool (APT) removes all software components after updated versions have been installed - Remove-Unused-Kernel-Packages

UBTU-18-010018 - The Ubuntu operating system must not have the Network Information Service (NIS) package installed.

CCI|CCI-000381

Rule-ID|SV-219157r610963_rule

STIG-ID|UBTU-18-010018

STIG-Legacy|SV-109643

STIG-Legacy|V-100539

Vuln-ID|V-219157

UBTU-18-010019 - The Ubuntu operating system must not have the rsh-server package installed.

Rule-ID|SV-219158r610963_rule

STIG-ID|UBTU-18-010019

STIG-Legacy|SV-109645

STIG-Legacy|V-100541

Vuln-ID|V-219158

UBTU-18-010021 - The Ubuntu operating system must deploy Endpoint Security for Linux Threat Prevention (ENSLTP) - package

CCI|CCI-001233

Rule-ID|SV-219159r610963_rule

STIG-ID|UBTU-18-010021

STIG-Legacy|SV-109649

STIG-Legacy|V-100545

Vuln-ID|V-219159

UBTU-18-010021 - The Ubuntu operating system must deploy Endpoint Security for Linux Threat Prevention (ENSLTP) - service

UBTU-18-010022 - The Ubuntu operating system must be configured to preserve log records from failure events - active

CCI|CCI-001665

Rule-ID|SV-219160r610963_rule

STIG-ID|UBTU-18-010022

STIG-Legacy|SV-109651

STIG-Legacy|V-100547

Vuln-ID|V-219160

UBTU-18-010022 - The Ubuntu operating system must be configured to preserve log records from failure events - enabled

UBTU-18-010022 - The Ubuntu operating system must be configured to preserve log records from failure events - installed

UBTU-18-010023 - The Ubuntu operating system must have an application firewall installed in order to control remote access methods.

CCI|CCI-002314

Rule-ID|SV-219161r610963_rule

STIG-ID|UBTU-18-010023

STIG-Legacy|SV-109653

STIG-Legacy|V-100549

Vuln-ID|V-219161

UBTU-18-010025 - The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system or storage media from the system being audited - active

Rule-ID|SV-219162r610963_rule

STIG-ID|UBTU-18-010025

STIG-Legacy|SV-109655

STIG-Legacy|V-100551

Vuln-ID|V-219162

UBTU-18-010025 - The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system or storage media from the system being audited - auditd is-active

UBTU-18-010025 - The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system or storage media from the system being audited - installed

UBTU-18-010025 - The Ubuntu operating system audit event multiplexor must be configured to off-load audit logs onto a different system or storage media from the system being audited - remote_server

UBTU-18-010030 - The Ubuntu operating system must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day - /etc/sssd/conf.d/*

CCI|CCI-002007

Rule-ID|SV-219163r610963_rule

STIG-ID|UBTU-18-010030

STIG-Legacy|SV-109657

STIG-Legacy|V-100553

Vuln-ID|V-219163

UBTU-18-010030 - The Ubuntu operating system must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day - /etc/sssd/sssd.conf

UBTU-18-010031 - The Ubuntu operating system must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt.

CCI|CCI-000366

Rule-ID|SV-219164r610963_rule

STIG-ID|UBTU-18-010031

STIG-Legacy|SV-109659

STIG-Legacy|V-100555

Vuln-ID|V-219164

UBTU-18-010032 - The Ubuntu operating system must display the date and time of the last successful account logon upon logon.

Rule-ID|SV-219165r610963_rule

STIG-ID|UBTU-18-010032

STIG-Legacy|SV-109661

STIG-Legacy|V-100557

Vuln-ID|V-219165

UBTU-18-010033 - The Ubuntu operating system must be configured so that three consecutive invalid logon attempts by a user automatically locks the account until released by an administrator.

CCI|CCI-000044

CCI|CCI-002238

Rule-ID|SV-219166r802355_rule

STIG-ID|UBTU-18-010033

STIG-Legacy|SV-109663

STIG-Legacy|V-100559

Vuln-ID|V-219166

UBTU-18-010035 - The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon - banner text

CCI|CCI-000050

Rule-ID|SV-219167r610963_rule

STIG-ID|UBTU-18-010035

STIG-Legacy|SV-109665

STIG-Legacy|V-100561

Vuln-ID|V-219167

UBTU-18-010035 - The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon - banner-message-enable

UBTU-18-010036 - The Ubuntu operating system must prevent direct login into the root account.

CCI|CCI-000770

Rule-ID|SV-219168r610963_rule

STIG-ID|UBTU-18-010036

STIG-Legacy|SV-109667

STIG-Legacy|V-100563

Vuln-ID|V-219168

UBTU-18-010037 - The Ubuntu operating system must be configured so that only users who need access to security functions are part of the sudo group.

CCI|CCI-001084

Rule-ID|SV-219169r610963_rule

STIG-ID|UBTU-18-010037

STIG-Legacy|SV-109669

STIG-Legacy|V-100565

Vuln-ID|V-219169

UBTU-18-010038 - The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting any publically accessible connection to the system.

CCI|CCI-000048

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-219170r610963_rule

STIG-ID|UBTU-18-010038

STIG-Legacy|SV-109671

STIG-Legacy|V-100567

Vuln-ID|V-219170

UBTU-18-010100 - The Ubuntu operating system must enforce password complexity by requiring that at least one upper-case character be used - ucredit

CCI|CCI-000192

Rule-ID|SV-219172r610963_rule

STIG-ID|UBTU-18-010100

STIG-Legacy|SV-109675

STIG-Legacy|V-100571

Vuln-ID|V-219172

UBTU-18-010101 - The Ubuntu operating system must enforce password complexity by requiring that at least one lower-case character be used - lcredit

Detections

Analytics

Revision 1.1

Jul 27, 2022

Functional Update