diff --git a/.github/workflows/srg-mapping-table.yaml b/.github/workflows/srg-mapping-table.yaml index 93ad0c9b80b..4ecab30ed63 100644 --- a/.github/workflows/srg-mapping-table.yaml +++ b/.github/workflows/srg-mapping-table.yaml @@ -45,19 +45,19 @@ jobs: env: PYTHONPATH: ${{ github.workspace }} - name: Generate XLSX for RHEL9 - run: python3 utils/create_srg_export.py -c controls/srg_gpos.yml -p rhel9 -m shared/references/disa-os-srg-v2r7.xml --out-format xlsx --output $PAGES_DIR/srg-mapping-rhel9.xlsx + run: python3 utils/create_srg_export.py -c controls/srg_gpos.yml -p rhel9 -m shared/references/disa-os-srg-v3r1.xml --out-format xlsx --output $PAGES_DIR/srg-mapping-rhel9.xlsx env: PYTHONPATH: ${{ github.workspace }} - name: Generate HTML for RHEL9 - run: python3 utils/create_srg_export.py -c controls/srg_gpos.yml -p rhel9 -m shared/references/disa-os-srg-v2r7.xml --out-format html --output $PAGES_DIR/srg-mapping-rhel9.html + run: python3 utils/create_srg_export.py -c controls/srg_gpos.yml -p rhel9 -m shared/references/disa-os-srg-v3r1.xml --out-format html --output $PAGES_DIR/srg-mapping-rhel9.html env: PYTHONPATH: ${{ github.workspace }} - name: Generate XLSX for RHEL10 - run: python3 utils/create_srg_export.py -c controls/srg_gpos.yml -p rhel10 -m shared/references/disa-os-srg-v2r7.xml --out-format xlsx --output $PAGES_DIR/srg-mapping-rhel10.xlsx + run: python3 utils/create_srg_export.py -c controls/srg_gpos.yml -p rhel10 -m shared/references/disa-os-srg-v3r1.xml --out-format xlsx --output $PAGES_DIR/srg-mapping-rhel10.xlsx env: PYTHONPATH: ${{ github.workspace }} - name: Generate HTML for RHEL10 - run: python3 utils/create_srg_export.py -c controls/srg_gpos.yml -p rhel10 -m shared/references/disa-os-srg-v2r7.xml --out-format html --output $PAGES_DIR/srg-mapping-rhel10.html + run: python3 utils/create_srg_export.py -c controls/srg_gpos.yml -p rhel10 -m shared/references/disa-os-srg-v3r1.xml --out-format html --output $PAGES_DIR/srg-mapping-rhel10.html env: PYTHONPATH: ${{ github.workspace }} - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4 diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake index b6506054135..a2b713cedbc 100644 --- a/cmake/SSGCommon.cmake +++ b/cmake/SSGCommon.cmake @@ -1095,7 +1095,7 @@ macro(ssg_build_html_srgmap_tables PRODUCT) OUTPUT "${CMAKE_BINARY_DIR}/tables/table-${PRODUCT}-srgmap.html" OUTPUT "${CMAKE_BINARY_DIR}/tables/table-${PRODUCT}-srgmap-flat.html" COMMAND "${CMAKE_COMMAND}" -E make_directory "${CMAKE_BINARY_DIR}/tables" - COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_SOURCE_DIR}/utils/gen_srg_table.py" --build-dir "${CMAKE_BINARY_DIR}" "${PRODUCT}" "${SSG_SHARED_REFS}/disa-os-srg-v2r7.xml" "${CMAKE_BINARY_DIR}/tables/table-${PRODUCT}-srgmap.html" "${CMAKE_BINARY_DIR}/tables/table-${PRODUCT}-srgmap-flat.html" + COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${PYTHON_EXECUTABLE}" "${CMAKE_SOURCE_DIR}/utils/gen_srg_table.py" --build-dir "${CMAKE_BINARY_DIR}" "${PRODUCT}" "${SSG_SHARED_REFS}/disa-os-srg-v3r1.xml" "${CMAKE_BINARY_DIR}/tables/table-${PRODUCT}-srgmap.html" "${CMAKE_BINARY_DIR}/tables/table-${PRODUCT}-srgmap-flat.html" DEPENDS ${PRODUCT}-compile-all "${CMAKE_CURRENT_BINARY_DIR}/ssg_build_compile_all-${PRODUCT}" COMMENT "[${PRODUCT}-tables] generating HTML SRG map tables" ) diff --git a/controls/srg_gpos.yml b/controls/srg_gpos.yml index 6cf82e5582a..0649e435760 100644 --- a/controls/srg_gpos.yml +++ b/controls/srg_gpos.yml @@ -1,7 +1,7 @@ policy: Security Requirements Guide - General Purpose Operating System title: Security Requirements Guide - General Purpose Operating System id: srg_gpos -version: 'v2r7' +version: 'v3r1' source: https://public.cyber.mil/stigs/downloads/ controls_dir: srg_gpos levels: diff --git a/controls/srg_gpos/SRG-OS-000024-GPOS-00007.yml b/controls/srg_gpos/SRG-OS-000024-GPOS-00007.yml index 15826d7e146..deb5b733a09 100644 --- a/controls/srg_gpos/SRG-OS-000024-GPOS-00007.yml +++ b/controls/srg_gpos/SRG-OS-000024-GPOS-00007.yml @@ -1,13 +1,10 @@ controls: - id: SRG-OS-000024-GPOS-00007 + title: '{{{ full_name }}} must display the Standard Mandatory DoD Notice and Consent + Banner until users acknowledge the usage conditions and take explicit actions + to log on for further access.' levels: - medium - - title: |- - {{{ full_name }}} must display the Standard Mandatory DoD Notice and Consent Banner until - users acknowledge the usage conditions and take explicit actions to log on for - further access. - status: does not meet rationale: |- The banner must be acknowledged by the user prior to allowing the user access to the operating system. diff --git a/controls/srg_gpos/SRG-OS-000069-GPOS-00037.yml b/controls/srg_gpos/SRG-OS-000069-GPOS-00037.yml index 96c17fc62f1..435b885d1d5 100644 --- a/controls/srg_gpos/SRG-OS-000069-GPOS-00037.yml +++ b/controls/srg_gpos/SRG-OS-000069-GPOS-00037.yml @@ -1,9 +1,9 @@ controls: - id: SRG-OS-000069-GPOS-00037 + title: '{{{ full_name }}} must enforce password complexity by requiring that at + least one uppercase character be used.' levels: - medium - title: {{{ full_name }}} must enforce password complexity by requiring that at - least one upper-case character be used. rules: - var_password_pam_retry=3 - accounts_password_pam_enforce_root diff --git a/controls/srg_gpos/SRG-OS-000070-GPOS-00038.yml b/controls/srg_gpos/SRG-OS-000070-GPOS-00038.yml index e3e6f09d30d..fd9632c482b 100644 --- a/controls/srg_gpos/SRG-OS-000070-GPOS-00038.yml +++ b/controls/srg_gpos/SRG-OS-000070-GPOS-00038.yml @@ -1,9 +1,9 @@ controls: - id: SRG-OS-000070-GPOS-00038 + title: '{{{ full_name }}} must enforce password complexity by requiring that at + least one lowercase character be used.' levels: - medium - title: {{{ full_name }}} must enforce password complexity by requiring that at - least one lower-case character be used. rules: - accounts_password_pam_enforce_root - var_password_pam_lcredit=1 diff --git a/controls/srg_gpos/SRG-OS-000072-GPOS-00040.yml b/controls/srg_gpos/SRG-OS-000072-GPOS-00040.yml index 81a04712103..5a1e25d8d1c 100644 --- a/controls/srg_gpos/SRG-OS-000072-GPOS-00040.yml +++ b/controls/srg_gpos/SRG-OS-000072-GPOS-00040.yml @@ -1,9 +1,9 @@ controls: - id: SRG-OS-000072-GPOS-00040 + title: '{{{ full_name }}} must require the change of at least 50 percent of the + total number of characters when passwords are changed.' levels: - medium - title: {{{ full_name }}} must require the change of at least 50% of the total - number of characters when passwords are changed. rules: - accounts_password_pam_difok - var_password_pam_difok=8 diff --git a/controls/srg_gpos/SRG-OS-000075-GPOS-00043.yml b/controls/srg_gpos/SRG-OS-000075-GPOS-00043.yml index d5dd419383d..d3a1f30a44f 100644 --- a/controls/srg_gpos/SRG-OS-000075-GPOS-00043.yml +++ b/controls/srg_gpos/SRG-OS-000075-GPOS-00043.yml @@ -1,8 +1,8 @@ controls: - id: SRG-OS-000075-GPOS-00043 + title: {{{ full_name }}} must enforce 24 hours/1 day as the minimum password lifetime. levels: - medium - title: {{{ full_name }}} must enforce 24 hours/1 day as the minimum password lifetime. rules: - var_accounts_minimum_age_login_defs=1 - accounts_minimum_age_login_defs diff --git a/controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml b/controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml index 2ae4ede9ded..8e65bb7a1bf 100644 --- a/controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml +++ b/controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml @@ -1,8 +1,8 @@ controls: - id: SRG-OS-000076-GPOS-00044 + title: Operating systems must enforce a 60-day maximum password lifetime restriction. levels: - medium - title: {{{ full_name }}} must enforce a 60-day maximum password lifetime restriction. rules: - var_accounts_maximum_age_login_defs=60 - accounts_maximum_age_login_defs diff --git a/controls/srg_gpos/SRG-OS-000077-GPOS-00045.yml b/controls/srg_gpos/SRG-OS-000077-GPOS-00045.yml deleted file mode 100644 index b02b7da4198..00000000000 --- a/controls/srg_gpos/SRG-OS-000077-GPOS-00045.yml +++ /dev/null @@ -1,11 +0,0 @@ -controls: - - id: SRG-OS-000077-GPOS-00045 - levels: - - medium - title: {{{ full_name }}} must prohibit password reuse for a minimum of five generations. - rules: - - var_password_pam_remember=5 - - var_password_pam_remember_control_flag=requisite_or_required - - accounts_password_pam_pwhistory_remember_password_auth - - accounts_password_pam_pwhistory_remember_system_auth - status: automated diff --git a/controls/srg_gpos/SRG-OS-000108-GPOS-00055.yml b/controls/srg_gpos/SRG-OS-000108-GPOS-00055.yml index 1eb3ad2dc76..d493b7bc6cb 100644 --- a/controls/srg_gpos/SRG-OS-000108-GPOS-00055.yml +++ b/controls/srg_gpos/SRG-OS-000108-GPOS-00055.yml @@ -1,9 +1,9 @@ controls: - id: SRG-OS-000108-GPOS-00055 + title: '{{{ full_name }}} must use multifactor authentication for local access to + nonprivileged accounts.' levels: - medium - title: {{{ full_name }}} must use multifactor authentication for local access - to non-privileged accounts. rules: - sshd_enable_pubkey_auth - configure_opensc_card_drivers diff --git a/controls/srg_gpos/SRG-OS-000113-GPOS-00058.yml b/controls/srg_gpos/SRG-OS-000113-GPOS-00058.yml index 37d01e84ca2..18faf87f371 100644 --- a/controls/srg_gpos/SRG-OS-000113-GPOS-00058.yml +++ b/controls/srg_gpos/SRG-OS-000113-GPOS-00058.yml @@ -2,9 +2,8 @@ controls: - id: SRG-OS-000113-GPOS-00058 levels: - medium - title: {{{ full_name }}} must implement replay-resistant authentication mechanisms for - network access to non-privileged accounts. - + title: '{{{ full_name }}} must implement replay-resistant authentication mechanisms + for network access to nonprivileged accounts.' status: inherently met check: |- {{{ full_name }}} supports this requirement and cannot be configured to be out of compliance. diff --git a/controls/srg_gpos/SRG-OS-000123-GPOS-00064.yml b/controls/srg_gpos/SRG-OS-000123-GPOS-00064.yml index d76f034aec9..27511ab2ffa 100644 --- a/controls/srg_gpos/SRG-OS-000123-GPOS-00064.yml +++ b/controls/srg_gpos/SRG-OS-000123-GPOS-00064.yml @@ -1,9 +1,9 @@ controls: - id: SRG-OS-000123-GPOS-00064 + title: The information system must automatically remove or disable emergency accounts + after the crisis is resolved or 72 hours. levels: - medium - title: {{{ full_name }}} must automatically remove or disable emergency accounts - after the crisis is resolved or 72 hours. rules: - account_temp_expire_date status: automated diff --git a/controls/srg_gpos/SRG-OS-000126-GPOS-00066.yml b/controls/srg_gpos/SRG-OS-000126-GPOS-00066.yml deleted file mode 100644 index 3c5f70dd57e..00000000000 --- a/controls/srg_gpos/SRG-OS-000126-GPOS-00066.yml +++ /dev/null @@ -1,7 +0,0 @@ -controls: - - id: SRG-OS-000126-GPOS-00066 - levels: - - medium - title: {{{ full_name }}} must terminate all sessions and network connections - related to nonlocal maintenance when nonlocal maintenance is completed. - status: pending diff --git a/controls/srg_gpos/SRG-OS-000138-GPOS-00069.yml b/controls/srg_gpos/SRG-OS-000138-GPOS-00069.yml index e33d680b962..308b6dd58c5 100644 --- a/controls/srg_gpos/SRG-OS-000138-GPOS-00069.yml +++ b/controls/srg_gpos/SRG-OS-000138-GPOS-00069.yml @@ -1,9 +1,9 @@ controls: - id: SRG-OS-000138-GPOS-00069 + title: Operating systems must prevent unauthorized and unintended information transfer + via shared system resources. levels: - medium - title: {{{ full_name }}} must prevent unauthorized and unintended information transfer - via shared system resources. rules: - dir_perms_world_writable_sticky_bits - dir_perms_world_writable_root_owned diff --git a/controls/srg_gpos/SRG-OS-000191-GPOS-00080.yml b/controls/srg_gpos/SRG-OS-000191-GPOS-00080.yml deleted file mode 100644 index c9a0b4ecdd2..00000000000 --- a/controls/srg_gpos/SRG-OS-000191-GPOS-00080.yml +++ /dev/null @@ -1,14 +0,0 @@ -controls: - - id: SRG-OS-000191-GPOS-00080 - levels: - - medium - title: |- - {{{ full_name }}} must employ automated mechanisms to determine the state of system - components with regard to flaw remediation using the following frequency: - continuously, 30 days, and annually, for external scans by Computer Network - Defense Service Provider (CNDSP). - - rules: - - package_mcafeetp_installed - status: automated - diff --git a/controls/srg_gpos/SRG-OS-000228-GPOS-00088.yml b/controls/srg_gpos/SRG-OS-000228-GPOS-00088.yml index c5d62cc8324..c0d324dd846 100644 --- a/controls/srg_gpos/SRG-OS-000228-GPOS-00088.yml +++ b/controls/srg_gpos/SRG-OS-000228-GPOS-00088.yml @@ -1,10 +1,11 @@ controls: - id: SRG-OS-000228-GPOS-00088 - levels: - - medium - title: Any publicly accessible connection to {{{ full_name }}} must display + title: Any publically accessible connection to the operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system. + + levels: + - medium rules: - sshd_enable_warning_banner - banner_etc_issue diff --git a/controls/srg_gpos/SRG-OS-000269-GPOS-00103.yml b/controls/srg_gpos/SRG-OS-000269-GPOS-00103.yml index a95e8013da2..02d55e0b9aa 100644 --- a/controls/srg_gpos/SRG-OS-000269-GPOS-00103.yml +++ b/controls/srg_gpos/SRG-OS-000269-GPOS-00103.yml @@ -1,10 +1,10 @@ controls: - id: SRG-OS-000269-GPOS-00103 - levels: - - medium - title: In the event of a system failure, {{{ full_name }}} must preserve any + title: In the event of a system failure, the operating system must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes. + levels: + - medium status: automated rules: - service_systemd-journald_enabled diff --git a/controls/srg_gpos/SRG-OS-000276-GPOS-00106.yml b/controls/srg_gpos/SRG-OS-000276-GPOS-00106.yml index 2fdfde876f0..5f3fda4b3a9 100644 --- a/controls/srg_gpos/SRG-OS-000276-GPOS-00106.yml +++ b/controls/srg_gpos/SRG-OS-000276-GPOS-00106.yml @@ -1,14 +1,16 @@ controls: - id: SRG-OS-000276-GPOS-00106 + title: '{{{ full_name }}} must notify system administrators and ISSOs when accounts are disabled.' levels: - medium - title: {{{ full_name }}} must notify system administrators and ISSOs when accounts are disabled. - rules: - - audit_rules_usergroup_modification_passwd - status: does not meet mitigation: |- Mitigate with third-party software. Although the listed mitigation is supporting the security function, it is not sufficient to reduce the residual risk of this requirement. - status_justification: - Notification when accounts are created/modified/deleted must be provided by a third-party application that will communicate that an audit record of these actions has been created. + rules: + - audit_rules_usergroup_modification_passwd + status: does not meet + status_justification: |- + Notification when accounts are created/modified/deleted must + be provided by a third-party application that will communicate that an audit record + of these actions has been created. diff --git a/controls/srg_gpos/SRG-OS-000304-GPOS-00121.yml b/controls/srg_gpos/SRG-OS-000304-GPOS-00121.yml index f3d1bea594f..cc90fc9fdd3 100644 --- a/controls/srg_gpos/SRG-OS-000304-GPOS-00121.yml +++ b/controls/srg_gpos/SRG-OS-000304-GPOS-00121.yml @@ -1,9 +1,9 @@ controls: - id: SRG-OS-000304-GPOS-00121 + title: '{{{ full_name }}} must notify system administrators (SAs) and information + system security officers (ISSOs) of account enabling actions.' levels: - medium - title: {{{ full_name }}} must notify system administrators and ISSOs of account - enabling actions. rules: - audit_rules_sudoers - audit_rules_sudoers_d diff --git a/controls/srg_gpos/SRG-OS-000324-GPOS-00125.yml b/controls/srg_gpos/SRG-OS-000324-GPOS-00125.yml index 54aa1d61156..dbc93f8b8ec 100644 --- a/controls/srg_gpos/SRG-OS-000324-GPOS-00125.yml +++ b/controls/srg_gpos/SRG-OS-000324-GPOS-00125.yml @@ -1,12 +1,10 @@ controls: - id: SRG-OS-000324-GPOS-00125 + title: '{{{ full_name }}} must prevent nonprivileged users from executing privileged + functions to include disabling, circumventing, or altering implemented security + safeguards/countermeasures.' levels: - high - title: |- - {{{ full_name }}} must prevent nonprivileged users from executing privileged functions - to include disabling, circumventing, or altering implemented security - safeguards/countermeasures. - rules: - disable_ctrlaltdel_burstaction - disable_ctrlaltdel_reboot diff --git a/controls/srg_gpos/SRG-OS-000341-GPOS-00132.yml b/controls/srg_gpos/SRG-OS-000341-GPOS-00132.yml index 22996a02dcf..80c82219468 100644 --- a/controls/srg_gpos/SRG-OS-000341-GPOS-00132.yml +++ b/controls/srg_gpos/SRG-OS-000341-GPOS-00132.yml @@ -1,12 +1,10 @@ controls: - id: SRG-OS-000341-GPOS-00132 + title: '{{{ full_name }}} must allocate audit record storage capacity to store at + least one week''s worth of audit records, when audit records are not immediately + sent to a central audit record storage facility.' levels: - low - title: |- - {{{ full_name }}} must allocate audit record storage capacity to store at least - one week's worth of audit records, when audit records are not immediately sent to a - central audit record storage facility. - rules: - grub2_audit_backlog_limit_argument - partition_for_var_log_audit diff --git a/controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml b/controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml index a1d02357d24..62dbeff86c2 100644 --- a/controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml +++ b/controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml @@ -1,12 +1,13 @@ controls: - id: SRG-OS-000355-GPOS-00143 + title: '{{{ full_name }}} must, for networked systems, compare internal information + system clocks at least every 24 hours with a server which is synchronized to one + of the redundant United States Naval Observatory (USNO) time servers, or a time + server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the + Global Positioning System (GPS).' + levels: - medium - title: {{{ full_name }}} must, for networked systems, compare internal information - system clocks at least every 24 hours with a server which is synchronized to one - of the redundant United States Naval Observatory (USNO) time servers, or a time - server designated for the appropriate DoD network (NIPRNet/SIPRNet), - and/or the Global Positioning System (GPS). rules: - chronyd_or_ntpd_set_maxpoll - chronyd_server_directive diff --git a/controls/srg_gpos/SRG-OS-000373-GPOS-00156.yml b/controls/srg_gpos/SRG-OS-000373-GPOS-00156.yml deleted file mode 100644 index 7e7ee512ef6..00000000000 --- a/controls/srg_gpos/SRG-OS-000373-GPOS-00156.yml +++ /dev/null @@ -1,14 +0,0 @@ -controls: - - id: SRG-OS-000373-GPOS-00156 - levels: - - medium - title: {{{ full_name }}} must require users to re-authenticate for privilege - escalation. - rules: - - use_pam_wheel_for_su - - sudo_remove_no_authenticate - - sudo_remove_nopasswd - - sudo_require_reauthentication - - disallow_bypass_password_sudo - - var_sudo_timestamp_timeout=always_prompt - status: automated diff --git a/controls/srg_gpos/SRG-OS-000373-GPOS-00157.yml b/controls/srg_gpos/SRG-OS-000373-GPOS-00157.yml deleted file mode 100644 index d046b52c6eb..00000000000 --- a/controls/srg_gpos/SRG-OS-000373-GPOS-00157.yml +++ /dev/null @@ -1,10 +0,0 @@ -controls: - - id: SRG-OS-000373-GPOS-00157 - levels: - - medium - title: {{{ full_name }}} must require users to re-authenticate when changing - roles. - rules: - - sudo_remove_no_authenticate - - sudo_remove_nopasswd - status: automated diff --git a/controls/srg_gpos/SRG-OS-000373-GPOS-00158.yml b/controls/srg_gpos/SRG-OS-000373-GPOS-00158.yml deleted file mode 100644 index 208065e24fa..00000000000 --- a/controls/srg_gpos/SRG-OS-000373-GPOS-00158.yml +++ /dev/null @@ -1,10 +0,0 @@ -controls: - - id: SRG-OS-000373-GPOS-00158 - levels: - - medium - title: {{{ full_name }}} must require users to re-authenticate when changing - authenticators. - rules: - - sudo_remove_no_authenticate - - sudo_remove_nopasswd - status: automated diff --git a/controls/srg_gpos/SRG-OS-000374-GPOS-00159.yml b/controls/srg_gpos/SRG-OS-000374-GPOS-00159.yml deleted file mode 100644 index 5d544932212..00000000000 --- a/controls/srg_gpos/SRG-OS-000374-GPOS-00159.yml +++ /dev/null @@ -1,18 +0,0 @@ -controls: - - id: SRG-OS-000374-GPOS-00159 - levels: - - medium - title: {{{ full_name }}} must require devices to re-authenticate when changing - authenticators. - status: not applicable - rationale: |- - Without re-authentication, devices may access resources or perform tasks for which they do not have authorization. - - When {{{ full_name }}} provide the capability to change device authenticators, it is critical the device re-authenticate. - check: - This requirement is NA for {{{ full_name }}}. - fixtext: - The requirement is NA. - No fix is required. - status_justification: - Devices are not assigned authenticators in {{{ full_name }}}. diff --git a/controls/srg_gpos/SRG-OS-000380-GPOS-00165.yml b/controls/srg_gpos/SRG-OS-000380-GPOS-00165.yml deleted file mode 100644 index c1a24296c71..00000000000 --- a/controls/srg_gpos/SRG-OS-000380-GPOS-00165.yml +++ /dev/null @@ -1,30 +0,0 @@ -controls: - - id: SRG-OS-000380-GPOS-00165 - levels: - - medium - title: {{{ full_name }}} must allow the use of a temporary password for system - logons with an immediate change to a permanent password. - status: inherently met - rationale: |- - Without providing this capability, an account may be created without a password. - Non-repudiation cannot be guaranteed once an account is created if a user is not forced to change the temporary password upon initial logon. - - Temporary passwords are typically used to allow access when new accounts are created or passwords are changed. - It is common practice for administrators to create temporary passwords for user accounts that allow the users to log on, yet force them to change the password once they have successfully authenticated. - check: |- - {{{ full_name }}} supports this requirement and cannot be configured to be out of compliance. - {{{ full_name }}} inherently meets this requirement. - fixtext: |- - {{{ full_name }}} inherently meets this requirement. - No fix is required. - artifact_description: |- - {{{ full_name }}} offers the following commands to facilitate the use of a temporary password. - - chage -d 0 [username] - (forces the user to change their password at next logon) - - passwd -e [username] - (expires the passwd for a given user forcing a change at next logon.) - status_justification: |- - {{{ full_name }}} has the capability to perform temporary passwords based on organization policy. - Configuration is not appropriate to define at an enterprise level. diff --git a/controls/srg_gpos/SRG-OS-000395-GPOS-00175.yml b/controls/srg_gpos/SRG-OS-000395-GPOS-00175.yml index 7c1132f71ba..43c28d2cbc6 100644 --- a/controls/srg_gpos/SRG-OS-000395-GPOS-00175.yml +++ b/controls/srg_gpos/SRG-OS-000395-GPOS-00175.yml @@ -2,10 +2,9 @@ controls: - id: SRG-OS-000395-GPOS-00175 levels: - medium - title: {{{ full_name }}} must verify remote disconnection at the termination of - nonlocal maintenance and diagnostic sessions, when used for nonlocal maintenance sessions. - If the remote connection is not closed and verified as closed, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. - Remote connections must be disconnected and verified as disconnected when nonlocal maintenance sessions have been terminated and are no longer available for use. + title: '{{{ full_name }}} must verify remote disconnection at the termination of + nonlocal maintenance and diagnostic sessions, when used for nonlocal maintenance + sessions.' check: {{{ full_name }}} supports this requirement and cannot be configured to be out of compliance. {{{ full_name }}} inherently meets this requirement. diff --git a/controls/srg_gpos/SRG-OS-000403-GPOS-00182.yml b/controls/srg_gpos/SRG-OS-000403-GPOS-00182.yml index df40b8ad4e6..c839bfe87b6 100644 --- a/controls/srg_gpos/SRG-OS-000403-GPOS-00182.yml +++ b/controls/srg_gpos/SRG-OS-000403-GPOS-00182.yml @@ -2,9 +2,9 @@ controls: - id: SRG-OS-000403-GPOS-00182 levels: - medium - title: {{{ full_name }}} must only allow the use of DoD PKI-established certificate - authorities for authentication in the establishment of protected sessions to - {{{ full_name }}}. + title: '{{{ full_name }}} must only allow the use of DoD PKI-established certificate + authorities for authentication in the establishment of protected sessions to the + operating system.' status: does not meet description: {{{ full_name }}} must only allow the use of DoD PKI-established certificate authorities for authentication in the establishment of protected sessions to the operating system. diff --git a/controls/srg_gpos/SRG-OS-000590-GPOS-00110.yml b/controls/srg_gpos/SRG-OS-000590-GPOS-00110.yml new file mode 100644 index 00000000000..7cba0195535 --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000590-GPOS-00110.yml @@ -0,0 +1,7 @@ +controls: + - id: SRG-OS-000590-GPOS-00110 + title: '{{{ full_name }}} must disable accounts when the accounts are no longer + associated to a user.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000690-GPOS-00140.yml b/controls/srg_gpos/SRG-OS-000690-GPOS-00140.yml new file mode 100644 index 00000000000..8803a3ace4e --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000690-GPOS-00140.yml @@ -0,0 +1,7 @@ +controls: + - id: SRG-OS-000690-GPOS-00140 + title: '{{{ full_name }}} must prohibit the use or connection of unauthorized hardware + components.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000705-GPOS-00150.yml b/controls/srg_gpos/SRG-OS-000705-GPOS-00150.yml new file mode 100644 index 00000000000..d2beecd5bd1 --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000705-GPOS-00150.yml @@ -0,0 +1,8 @@ +controls: + - id: SRG-OS-000705-GPOS-00150 + title: '{{{ full_name }}} must implement multifactor authentication for local, network, + and/or remote access to privileged accounts and/or nonprivileged accounts such + that the device meets organization-defined strength of mechanism requirements.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000710-GPOS-00160.yml b/controls/srg_gpos/SRG-OS-000710-GPOS-00160.yml new file mode 100644 index 00000000000..a5ac0562bbb --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000710-GPOS-00160.yml @@ -0,0 +1,8 @@ +controls: + - id: SRG-OS-000710-GPOS-00160 + title: '{{{ full_name }}} must, for password-based authentication, verify when users + create or update passwords the passwords are not found on the list of commonly-used, + expected, or compromised passwords in IA-5 (1) (a).' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000720-GPOS-00170.yml b/controls/srg_gpos/SRG-OS-000720-GPOS-00170.yml new file mode 100644 index 00000000000..6207f8dc5ea --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000720-GPOS-00170.yml @@ -0,0 +1,7 @@ +controls: + - id: SRG-OS-000720-GPOS-00170 + title: '{{{ full_name }}} must for password-based authentication, require immediate + selection of a new password upon account recovery.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000725-GPOS-00180.yml b/controls/srg_gpos/SRG-OS-000725-GPOS-00180.yml new file mode 100644 index 00000000000..6bcff0043a7 --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000725-GPOS-00180.yml @@ -0,0 +1,7 @@ +controls: + - id: SRG-OS-000725-GPOS-00180 + title: '{{{ full_name }}} must for password-based authentication, allow user selection + of long passwords and passphrases, including spaces and all printable characters.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000730-GPOS-00190.yml b/controls/srg_gpos/SRG-OS-000730-GPOS-00190.yml new file mode 100644 index 00000000000..23d323a5078 --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000730-GPOS-00190.yml @@ -0,0 +1,12 @@ +controls: + - id: SRG-OS-000730-GPOS-00190 + title: '{{{ full_name }}} must, for password-based authentication, employ automated + tools to assist the user in selecting strong password authenticators.' + levels: + - medium + status: automated + rules: + - accounts_password_pam_maxclassrepeat + - var_password_pam_maxclassrepeat=3 + - var_password_pam_dictcheck=1 + - accounts_password_pam_dictcheck diff --git a/controls/srg_gpos/SRG-OS-000745-GPOS-00210.yml b/controls/srg_gpos/SRG-OS-000745-GPOS-00210.yml new file mode 100644 index 00000000000..811cf702a98 --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000745-GPOS-00210.yml @@ -0,0 +1,6 @@ +controls: + - id: SRG-OS-000745-GPOS-00210 + title: '{{{ full_name }}} must accept only external credentials that are NIST-compliant.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000755-GPOS-00220.yml b/controls/srg_gpos/SRG-OS-000755-GPOS-00220.yml new file mode 100644 index 00000000000..95ddcdeaf5f --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000755-GPOS-00220.yml @@ -0,0 +1,12 @@ +controls: + - id: SRG-OS-000755-GPOS-00220 + title: '{{{ full_name }}} must monitor the use of maintenance tools that execute + with increased privilege.' + levels: + - medium + status: automated + rules: + - audit_rules_privileged_commands_su + - audit_rules_privileged_commands_sudo + - audit_rules_privileged_commands_sudoedit + - audit_rules_suid_privilege_function diff --git a/controls/srg_gpos/SRG-OS-000775-GPOS-00230.yml b/controls/srg_gpos/SRG-OS-000775-GPOS-00230.yml new file mode 100644 index 00000000000..9e2a568d42f --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000775-GPOS-00230.yml @@ -0,0 +1,7 @@ +controls: + - id: SRG-OS-000775-GPOS-00230 + title: '{{{ full_name }}} must include only approved trust anchors in trust stores + or certificate stores managed by the organization.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000780-GPOS-00240.yml b/controls/srg_gpos/SRG-OS-000780-GPOS-00240.yml new file mode 100644 index 00000000000..fca13fb9c2d --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000780-GPOS-00240.yml @@ -0,0 +1,7 @@ +controls: + - id: SRG-OS-000780-GPOS-00240 + title: '{{{ full_name }}} must provide protected storage for cryptographic keys + with organization-defined safeguards and/or hardware protected key store.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000785-GPOS-00250.yml b/controls/srg_gpos/SRG-OS-000785-GPOS-00250.yml new file mode 100644 index 00000000000..cd706a8e51d --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000785-GPOS-00250.yml @@ -0,0 +1,7 @@ +controls: + - id: SRG-OS-000785-GPOS-00250 + title: '{{{ full_name }}} must synchronize system clocks within and between systems + or system components.' + levels: + - medium + status: pending diff --git a/controls/srg_gpos/SRG-OS-000805-GPOS-00260.yml b/controls/srg_gpos/SRG-OS-000805-GPOS-00260.yml new file mode 100644 index 00000000000..59fe04a46b4 --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000805-GPOS-00260.yml @@ -0,0 +1,10 @@ +controls: + - id: SRG-OS-000805-GPOS-00260 + title: '{{{ full_name }}} must employ automated patch management tools to facilitate + flaw remediation to the organization-defined system components.' + levels: + - medium + status: automated + rules: + - dnf-automatic_apply_updates + - package_dnf-automatic_installed diff --git a/docs/manual/developer/03_creating_content.md b/docs/manual/developer/03_creating_content.md index c89155e1068..572814dc930 100644 --- a/docs/manual/developer/03_creating_content.md +++ b/docs/manual/developer/03_creating_content.md @@ -1257,7 +1257,7 @@ In order for export for DISA the IDs of your control must be SRG ID form the Gen If you have an existing product that you want to base your new STIG you can create the skeleton with the following command: - $ ./utils/build_stig_control.py --split -p rhel9 -m shared/references/disa-os-srg-v2r7.xml -o controls/srg_gpos.yml + $ ./utils/build_stig_control.py --split -p rhel9 -m shared/references/disa-os-srg-v3r1.xml -o controls/srg_gpos.yml The manual (`-m`) should be an SRG XML from DISA. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml index f65a2c5820a..91a5e936eea 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml @@ -56,7 +56,7 @@ references: nist: AU-2(d),AU-12(c),AC-6(9),CM-6(a) nist-csf: DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.PT-1 ospp: FAU_GEN.1.1.c - srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000064-GPOS-0003,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-APP-000029-CTR-000085,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255 + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000064-GPOS-0003,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-APP-000029-CTR-000085,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255,SRG-OS-000755-GPOS-00220 stigid@ol7: OL07-00-030680 stigid@ol8: OL08-00-030190 stigid@rhel8: RHEL-08-030190 diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml index bbab6b794ff..46a075f9719 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml @@ -56,7 +56,7 @@ references: nist: AU-2(d),AU-12(c),AC-6(9),CM-6(a) nist-csf: DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.PT-1 ospp: FAU_GEN.1.1.c - srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-APP-000029-CTR-000085,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255 + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-APP-000029-CTR-000085,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255,SRG-OS-000755-GPOS-00220 stigid@ol7: OL07-00-030690 stigid@ol8: OL08-00-030550 stigid@rhel8: RHEL-08-030550 diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml index 49e68863064..e2157d3172f 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml @@ -56,7 +56,7 @@ references: nist-csf: DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.PT-1 nist@sle15: AU-3,AU-3.1,AU-12(a),AU-12.1(ii),AU-12.1(iv) ospp: FAU_GEN.1.1.c - srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-APP-000495-CTR-001235 + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-APP-000495-CTR-001235,SRG-OS-000755-GPOS-00220 stigid@sle15: SLES-15-030330 stigid@ubuntu2004: UBTU-20-010162 stigid@ubuntu2204: UBTU-22-654110 diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/rule.yml index db1bb2de969..04a1fcbc6b0 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/rule.yml @@ -53,7 +53,7 @@ references: cis@ubuntu2204: 4.1.3.2 disa: CCI-001814,CCI-001882,CCI-001889,CCI-001880,CCI-001881,CCI-001878,CCI-001879,CCI-001875,CCI-001877,CCI-001914,CCI-002233,CCI-002234 nist: CM-5(1),AU-7(a),AU-7(b),AU-8(b),AU-12(3),AC-6(9) - srg: SRG-OS-000326-GPOS-00126,SRG-OS-000327-GPOS-00127,SRG-APP-000343-CTR-000780,SRG-APP-000381-CTR-000905 + srg: SRG-OS-000326-GPOS-00126,SRG-OS-000327-GPOS-00127,SRG-APP-000343-CTR-000780,SRG-APP-000381-CTR-000905,SRG-OS-000755-GPOS-00220 stigid@ol7: OL07-00-030360 stigid@ol8: OL08-00-030000 stigid@rhel8: RHEL-08-030000 diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_sudo_log_events/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_sudo_log_events/rule.yml index d63a37780c7..7e70f98a940 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_sudo_log_events/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_sudo_log_events/rule.yml @@ -45,7 +45,7 @@ identifiers: references: cis@sle12: 4.1.15 - cis@sle15: 4.1.15 + cis@sle15: 4.1.15 cis@ubuntu2204: 4.1.3.3 disa: CCI-000172,CCI-002884 pcidss: Req-10.2.2,Req-10.2.5.b diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml index 7c97ee4681a..c4c55f3e174 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml @@ -28,7 +28,7 @@ identifiers: references: disa: CCI-000366 nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4) - srg: SRG-OS-000480-GPOS-00225 + srg: SRG-OS-000480-GPOS-00225,SRG-OS-000072-GPOS-00040 stigid@ol8: OL08-00-020300 stigid@rhel8: RHEL-08-020300 stigid@ubuntu2004: UBTU-20-010056 diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml index 59b15a14794..749e12a56ce 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml @@ -35,7 +35,7 @@ references: iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4) nist-csf: PR.AC-1,PR.AC-6,PR.AC-7 - srg: SRG-OS-000072-GPOS-00040 + srg: SRG-OS-000072-GPOS-00040,SRG-OS-000730-GPOS-00190 stigid@ol7: OL07-00-010190 stigid@ol8: OL08-00-020140 stigid@rhel8: RHEL-08-020140 diff --git a/linux_os/guide/system/software/sudo/package_sudo_installed/policy/stig/shared.yml b/linux_os/guide/system/software/sudo/package_sudo_installed/policy/stig/shared.yml index 21772bb6844..3cc87804ed6 100644 --- a/linux_os/guide/system/software/sudo/package_sudo_installed/policy/stig/shared.yml +++ b/linux_os/guide/system/software/sudo/package_sudo_installed/policy/stig/shared.yml @@ -21,7 +21,4 @@ checktext: |- fixtext: |- The sudo package can be installed with the following command: - $ sudo dnf install sudo - -vuln_discussion: |- - "sudo" is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done. + # dnf install sudo diff --git a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/policy/stig/shared.yml b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/policy/stig/shared.yml new file mode 100644 index 00000000000..6740f3f6807 --- /dev/null +++ b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/policy/stig/shared.yml @@ -0,0 +1,25 @@ +srg_requirement: |- + {{{ full_name }}} must configure dnf-automatic to Install Available Updates Automatically. + + +vuldiscussion: |- + Using automated tools to support patch management helps to ensure the timeliness and + completeness of system patching operations. + +checktext: |- + To verify that packages comprising the available updates will be automatically installed by dnf-automatic, run the following command: + + $ sudo grep apply_updates /etc/dnf/automatic.conf + + The output should return the following: + + apply_updates = yes + + If apply_updates line is missing, commented out, or not set to "yes", this is a finding. + +fixtext: |- + Configure {{{ full_name }}} to automatically apply updates. + + Edit the file "/etc/dnf/automatic.conf" and add the following: + + apply_updates = yes diff --git a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/rule.yml b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/rule.yml index f6ef6ecab8b..d9994ce0680 100644 --- a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/rule.yml +++ b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/rule.yml @@ -28,7 +28,7 @@ references: ism: 0940,1144,1467,1472,1483,1493,1494,1495 nist: SI-2(5),CM-6(a),SI-2(c) ospp: FMT_SMF_EXT.1 - srg: SRG-OS-000191-GPOS-00080 + srg: SRG-OS-000805-GPOS-00260 ocil_clause: 'apply_updates is not set to yes' diff --git a/linux_os/guide/system/software/updating/package_dnf-automatic_installed/policy/stig/shared.yml b/linux_os/guide/system/software/updating/package_dnf-automatic_installed/policy/stig/shared.yml new file mode 100644 index 00000000000..bec19347c9a --- /dev/null +++ b/linux_os/guide/system/software/updating/package_dnf-automatic_installed/policy/stig/shared.yml @@ -0,0 +1,21 @@ +srg_requirement: |- + {{{ full_name }}} must have the dnf-automatic package installed. + +vuldiscussion: |- + "dnf-automatic" is a package designed to allow automatic updates of {{{ full_name }}}. + +checktext: |- + Verify that {{{ full_name }}} dnf-automatic package is installed with the following command: + + $ sudo dnf list --installed dnf-automatic + + Example output: + + dnf-automatic.x86_64 4.20.0-6.el10 + + If the "dnf-automatic" package is not installed, this is a finding. + +fixtext: |- + The dnf-automatic package can be installed with the following command: + + $ sudo dnf install dnf-automatic diff --git a/shared/references/disa-os-srg-v2r7.xml b/shared/references/disa-os-srg-v3r1.xml similarity index 76% rename from shared/references/disa-os-srg-v2r7.xml rename to shared/references/disa-os-srg-v3r1.xml index 4aa04b994d7..6a4684c3d3e 100644 --- a/shared/references/disa-os-srg-v2r7.xml +++ b/shared/references/disa-os-srg-v3r1.xml @@ -1,18 +1,18 @@ -acceptedGeneral Purpose Operating System Security Requirements GuideThis Security Requirements Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 7 Benchmark Date: 24 Jan 20243.4.1.229161.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-OS-000001<GroupDescription></GroupDescription>SRG-OS-000001-GPOS-00001The operating system must provide automated mechanisms for supporting account management functions.<VulnDiscussion>Enterprise environments make account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other errors. +acceptedGeneral Purpose Operating System Security Requirements GuideThis Security Requirements Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 1 Benchmark Date: 24 Jul 20243.51.10.03I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>