1.0 - The file permissions, ownership, and group membership of system files and commands must match the vendor values.

800-53|SI-7(1)

1.2 - The cryptographic hash of system files and commands must match vendor values.

1.3.0 - The system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

800-53|AC-8

CAT|II

CCI|CCI-000048

1.4.0 - The system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.

1.5.0 - The system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.

1.6.0 - The system must enable a user session lock until that user re-establishes access using established ID and auth procedures.

800-53|AC-11

1.6.0 - The system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.

CCI|CCI-000056

1.6.1 - The operating system must uniquely identify and authenticate users using multifactor authentication via graphical logon.

800-53|IA-5(11)

1.6.1 - The system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.

800-53|IA-5

CCI|CCI-001948

CCI|CCI-001953

CCI|CCI-001954

1.6.2 - The system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.

1.7 - The operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.

1.7 - The system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.

CCI|CCI-000057

1.8.1 - The system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface.

1.8.2 - The system must prevent a user from overriding the session idle-delay setting for the graphical user interface.

1.9.0 - The system must have the screen package installed.

800-53|CM-7

CSCv6|2.2

1.100 - The system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.

1.101 - The system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.

1.110 - The system must initiate a session lock for graphical user interfaces when the screensaver is activated.

1.118 - The system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords.

CCI|CCI-000192

1.119 - When passwords are changed or new passwords are established, pwquality must be used.

800-53|AC-7

CSCv6|16.7

1.120 - When passwords are changed or new passwords are established, the new password must contain at least 1 upper-case character.

800-53|IA-5(1)

1.130 - When passwords are changed or new passwords are established, the new password must contain at least 1 lower-case character.

1.140 - When passwords are changed or new passwords are assigned, the new password must contain at least one numeric character.

1.150 - When passwords are changed or new passwords are assigned, the new password must contain at least one special character.

1.160 - When passwords are changed a minimum of eight of the total number of characters must be changed.

1.170 - When passwords are changed a minimum of four character classes must be changed.

1.180 - When passwords are changed the number of repeating consecutive characters must not be more than three characters.

1.190 - When passwords are changed the number of repeating characters of the same class must not be more than 4 characters.

1.200 - The PAM system service must be configured to store only encrypted representations of passwords.

1.210 - The shadow file must be configured to store only encrypted representations of passwords.

800-53|SC-13

1.220 - User and group account administration utilities must be configured to store only encrypted representations of passwords.

1.230 - Passwords for new users must be restricted to a 24 hours/1 day minimum lifetime.

1.240 - Passwords must be restricted to a 24 hours/1 day minimum lifetime.

1.250 - Passwords for new users must be restricted to a 60-day maximum lifetime.

1.260 - Existing passwords must be restricted to a 60-day maximum lifetime.

1.270 - Passwords must be prohibited from reuse for a minimum of five generations.

1.280 - Passwords must be a minimum of 15 characters in length.

1.290 - The system must not have accounts configured with blank or null passwords - password-auth

800-53|CM-6

CAT|I

CCI|CCI-000366

1.290 - The system must not have accounts configured with blank or null passwords - system-auth

1.300 - The SSH daemon must not allow authentication using an empty password.

1.310 - The system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.

800-53|AC-2

1.320 - Accounts subject to three unsuccessful logon attempts within 15 minutes must be locked - password-auth-ac [default=die]

1.320 - Accounts subject to three unsuccessful logon attempts within 15 minutes must be locked - password-auth-ac auth required

1.320 - Accounts subject to three unsuccessful logon attempts within 15 minutes must be locked - system-auth-ac [default=die]

1.320 - Accounts subject to three unsuccessful logon attempts within 15 minutes must be locked - system-auth-ac auth required

1.330 - If 3 unsuccessful root logon attempts within 15 minutes occur the account must be locked - password-auth-ac [default=die]

1.330 - If 3 unsuccessful root logon attempts within 15 minutes occur the account must be locked - password-auth-ac auth required

1.330 - If 3 unsuccessful root logon attempts within 15 minutes occur the account must be locked - system-auth-ac [default=die]

1.330 - If 3 unsuccessful root logon attempts within 15 minutes occur the account must be locked - system-auth-ac auth required

1.340 - Users must provide a password for privilege escalation.

800-53|AC-3(7)

1.350 - Users must re-authenticate for privilege escalation.

1.430 - The delay between logon prompts following a failed console logon attempt must be at least four seconds.

1.440 - The system must not allow an unattended or automatic logon to the system via a graphical user interface.

800-53|IA-2

1.450 - The system must not allow an unrestricted logon to the system.

1.460 - The system must not allow users to override SSH environment variables.

1.470 - The system must not allow a non-certificate trusted host SSH logon to the system.

800-53|AC-14

1.480 - systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes - password

800-53|SI-7(9)

CCI|CCI-000213

1.480 - systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes - superusers

1.481 - The system must require authentication upon booting into single-user and maintenance modes.

1.482 - systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes - password

1.482 - systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes - superusers

1.490 - systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes - password

1.490 - systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes - superusers

1.491 - systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes - password

1.491 - systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes - superusers

1.500 - The system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication - module

CCI|CCI-000766

1.500 - The system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication - pam_pkcs11

1.500 - The system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication - removal

2.000 - The rsh-server package must not be installed.

800-53|CM-7(4)

2.010 - The ypserv package must not be installed.

2.019 - The system must have a host-based intrusion detection tool installed. - MFEhiplsm package

800-53|CM-7(5)

CCI|CCI-001263

2.019 - The system must have a host-based intrusion detection tool installed. - MFEhiplsm process

CSCv6|3.1

2.020 - The system must prevent non-privileged users from executing privileged functions.

800-53|AC-3(4)

800-53|AC-6(10)

2.030 - A file integrity tool must verify the baseline operating system configuration at least weekly - aide installed

2.030 - A file integrity tool must verify the baseline operating system configuration at least weekly - cron

2.040 - Designated personnel must be notified if baseline configurations are changed in an unauthorized manner.

2.050 - The system must prevent the install of software, patches, service packs, device drivers, or OS components without verification.

800-53|SI-7(6)

2.060 - The system must prevent the install of software, patches, service packs, device drivers, or OS components without verification.

2.100 - USB mass storage must be disabled.

2.101 - The Datagram Congestion Control Protocol (DCCP) kernel module must be disabled unless required.

CSCv6|9.1

2.110 - File system automounter must be disabled unless required.

2.200 - The system must remove all software components after updated versions have been installed.

800-53|SI-7

800-53|AC-3(3)

2.220 - The operating system must enable the SELinux targeted policy.

2.230 - The x86 Ctrl-Alt-Delete key sequence must be disabled - GUI

2.230 - The x86 Ctrl-Alt-Delete key sequence must be disabled - systemctl

2.240 - The system must define default permissions for all users in such a way that the user can only read and modify their own files.

2.250 - The system must be a vendor supported release.

800-53|CM-8

2.260 - Vendor packaged system security patches and updates must be installed and up to date.

800-53|SI-2

2.270 - The system must not have unnecessary accounts.

2.300 - All Group Identifiers (GIDs) referenced in the /etc/passwd file must be defined in the /etc/group file.

2.310 - The root account must be the only account having unrestricted access to the system.

800-53|AC-6(5)

CSCv6|5.1

2.320 - All files and directories must have a valid owner.

800-53|AC-16(3)

2.330 - All files and directories must have a valid group owner.

2.600 - All local interactive users must have a home directory assigned in the /etc/passwd file.

2.610 - All local interactive user accounts, upon creation, must be assigned a home directory.

2.620 - All local interactive user home directories defined in the /etc/passwd file must exist.

2.630 - All local interactive user home directories must have mode 0750 or less permissive.

2.640 - All local interactive user home directories must be owned by their respective users.

2.650 - All local interactive user home directories must be group-owned by the home directory owners primary group.

Detections

Analytics

Revision 1.8

Mar 1, 2021

Functional Update

Informational Update

Miscellaneous