CCI|CCI-001942

Title

The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.

Reference Item Details

Category: 2013

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AIX7-00-001012 - AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts - lssrc sshdUnixDISA STIG AIX 7.x v2r6
AIX7-00-001012 - AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts - openssh.base.serverUnixDISA STIG AIX 7.x v2r6
AOSX-13-000570 - The macOS system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.UnixDISA STIG Apple Mac OSX 10.13 v2r5
AOSX-14-000040 - The macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions - OpenSSH VersionUnixDISA STIG Apple Mac OSX 10.14 v2r6
AOSX-14-000040 - The macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions - SSHD currently runningUnixDISA STIG Apple Mac OSX 10.14 v2r6
AOSX-14-000040 - The macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions - SSHD service disabledUnixDISA STIG Apple Mac OSX 10.14 v2r6
AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - OpenSSH versionUnixDISA STIG Apple Mac OSX 10.15 v1r8
AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - SSHD currently runningUnixDISA STIG Apple Mac OSX 10.15 v1r8
AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - SSHD service disabledUnixDISA STIG Apple Mac OSX 10.15 v1r8
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r5
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r6
APPL-12-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 12 v1r3
Catalina - Enable SSH for Remote Access SessionsUnixNIST macOS Catalina v1.5.0 - All Profiles
EDGE-00-000062 - The built-in DNS client must be disabled.WindowsDISA STIG Edge v1r5
ESXI-06-300037 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by using Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-300038 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by using the vSphere Authentication Proxy.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-300039 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by restricting use of Active Directory ESX Admin group membership.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-67-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r2
ESXI-67-000038 - ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r2
ESXI-67-000039 - Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r2
PHTN-67-000068 - The Photon operating system must use OpenSSH for remote maintenance sessions.UnixDISA STIG VMware vSphere 6.7 Photon OS v1r3
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception) - filtersUnixDISA STIG Solaris 11 X86 v2r6
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception) - filtersUnixDISA STIG Solaris 11 SPARC v2r6
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception) - firewall/pflogUnixDISA STIG Solaris 11 SPARC v2r6
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception) - serviceUnixDISA STIG Solaris 11 SPARC v2r6
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception) - serviceUnixDISA STIG Solaris 11 X86 v2r6
SYMP-AG-000380 - Symantec ProxySG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.BlueCoatDISA Symantec ProxySG Benchmark ALG v1r3
UBTU-16-030200 - The Ubuntu operating system must enforce SSHv2 for network access to all accounts.UnixDISA STIG Ubuntu 16.04 LTS v2r3
UBTU-18-010412 - The Ubuntu operating system must enforce SSHv2 for network access to all accounts.UnixDISA STIG Ubuntu 18.04 LTS v2r8
WN12-AC-000014-DC - The computer clock synchronization tolerance must be limited to 5 minutes or less.WindowsDISA Windows Server 2012 and 2012 R2 DC STIG v3r4
WN16-DC-000020 - Kerberos user logon restrictions must be enforced.WindowsDISA Windows Server 2016 STIG v2r4
WN16-DC-000030 - The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.WindowsDISA Windows Server 2016 STIG v2r4
WN16-DC-000040 - The Kerberos user ticket lifetime must be limited to 10 hours or less.WindowsDISA Windows Server 2016 STIG v2r4
WN16-DC-000050 - The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2016 STIG v2r4
WN16-DC-000060 - The computer clock synchronization tolerance must be limited to 5 minutes or less.WindowsDISA Windows Server 2016 STIG v2r4
WN19-DC-000020 - Windows Server 2019 Kerberos user logon restrictions must be enforced.WindowsDISA Windows Server 2019 STIG v2r4
WN19-DC-000030 - Windows Server 2019 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.WindowsDISA Windows Server 2019 STIG v2r4
WN19-DC-000040 - Windows Server 2019 Kerberos user ticket lifetime must be limited to 10 hours or less.WindowsDISA Windows Server 2019 STIG v2r4
WN19-DC-000050 - Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2019 STIG v2r4
WN19-DC-000060 - Windows Server 2019 computer clock synchronization tolerance must be limited to five minutes or less.WindowsDISA Windows Server 2019 STIG v2r4
WN22-DC-000020 - Windows Server 2022 Kerberos user logon restrictions must be enforced.WindowsDISA Windows Server 2022 STIG v1r1
WN22-DC-000030 - Windows Server 2022 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.WindowsDISA Windows Server 2022 STIG v1r1
WN22-DC-000040 - Windows Server 2022 Kerberos user ticket lifetime must be limited to 10 hours or less.WindowsDISA Windows Server 2022 STIG v1r1
WN22-DC-000050 - Windows Server 2022 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2022 STIG v1r1
WN22-DC-000060 - Windows Server 2022 computer clock synchronization tolerance must be limited to five minutes or less.WindowsDISA Windows Server 2022 STIG v1r1